From bfc25f0cec4622e0d4ba9bec2024dd9b32a385a9 Mon Sep 17 00:00:00 2001 From: d1vious Date: Sat, 30 Oct 2021 21:31:04 -0400 Subject: [PATCH 1/7] adding skeleton for ssa package generation --- bin/generate.py | 101 ++--- contentctl.py | 9 +- ...tolen_credentials_via_mimikatz_modules.yml | 181 +++++++++ ...en_credentials_via_powersploit_modules.yml | 185 ++++++++++ ...ntial_strength_via_dsinternals_modules.yml | 161 ++++++++ .../detections/attempt_to_delete_services.yml | 109 ++++++ .../attempt_to_disable_services.yml | 111 ++++++ ...dential_dump_from_registry_via_reg_exe.yml | 150 ++++++++ ..._of_fgdump_and_cachedump_with_s_option.yml | 158 ++++++++ ..._of_fgdump_and_cachedump_with_v_option.yml | 155 ++++++++ ...cative_of_lazagne_command_line_options.yml | 150 ++++++++ ...nternals_credential_conversion_modules.yml | 161 ++++++++ ...dicative_of_use_of_dsinternals_modules.yml | 164 +++++++++ ..._indicative_of_use_of_mimikatz_modules.yml | 154 ++++++++ ...dicative_of_use_of_powersploit_modules.yml | 155 ++++++++ ...crosoft_debuggers_peek_into_the_kernel.yml | 159 ++++++++ ...ft_debuggers_via_z_command_line_option.yml | 155 ++++++++ ...present_in_powersploit_and_dsinternals.yml | 150 ++++++++ dist/ssa/detections/delete_a_net_user.yml | 112 ++++++ .../deny_permission_using_cacls_utility.yml | 147 ++++++++ ...detect_dump_lsass_memory_using_comsvcs.yml | 149 ++++++++ dist/ssa/detections/detect_kerberoasting.yml | 152 ++++++++ dist/ssa/detections/detect_pass_the_hash.yml | 166 +++++++++ ...ohibited_applications_spawning_cmd_exe.yml | 162 ++++++++ .../detections/disable_net_user_account.yml | 111 ++++++ .../first_time_seen_command_line_argument.yml | 157 ++++++++ .../grant_permission_using_cacls_utility.yml | 147 ++++++++ ...o_user_content_via_powersploit_modules.yml | 166 +++++++++ ...count_creation_via_powersploit_modules.yml | 150 ++++++++ ..._deletion_of_logs_via_mimikatz_modules.yml | 151 ++++++++ ...ng_of_accounts_via_dsinternals_modules.yml | 155 ++++++++ ...s_and_policies_via_dsinternals_modules.yml | 160 ++++++++ ...ctory_elements_via_powersploit_modules.yml | 161 ++++++++ ...nd_persistence_via_powersploit_modules.yml | 166 +++++++++ ...ivilege_elevation_via_mimikatz_modules.yml | 157 ++++++++ ...d_process_control_via_mimikatz_modules.yml | 160 ++++++++ ...rocess_control_via_powersploit_modules.yml | 171 +++++++++ ...fy_acls_permission_of_files_or_folders.yml | 132 +++++++ ...lbas_applications_in_short_time_period.yml | 160 ++++++++ ...ction_by_machine_learning_method_-_ssa.yml | 105 ++++++ ...ash_observed_at_the_destination_device.yml | 167 +++++++++ ...observed_by_an_event_collecting_device.yml | 169 +++++++++ ...en_credentials_via_powersploit_modules.yml | 153 ++++++++ ...rare_parent-child_process_relationship.yml | 138 +++++++ ...counts_and_groups_via_mimikatz_modules.yml | 157 ++++++++ ...s_and_policies_via_powersploit_modules.yml | 181 +++++++++ ...infrastructure_via_powersploit_modules.yml | 174 +++++++++ ...rs_and_domains_via_powersploit_modules.yml | 162 ++++++++ ...cess_to_computers_via_mimikatz_modules.yml | 147 ++++++++ ...ystem_elements_via_powersploit_modules.yml | 182 +++++++++ ...sses_and_services_via_mimikatz_modules.yml | 151 ++++++++ ..._shared_resources_via_mimikatz_modules.yml | 160 ++++++++ ...ared_resources_via_powersploit_modules.yml | 164 +++++++++ ..._opportunities_via_powersploit_modules.yml | 177 +++++++++ ...f_connectivity_via_powersploit_modules.yml | 163 +++++++++ ...ores_and_services_via_mimikatz_modules.yml | 172 +++++++++ ...efensive_tools_via_powersploit_modules.yml | 156 ++++++++ ..._opportunities_via_powersploit_modules.yml | 153 ++++++++ ...ing_opportunities_via_mimikatz_modules.yml | 162 ++++++++ .../resize_shadowstorage_volume.yml | 113 ++++++ ...ng_credentials_via_dsinternals_modules.yml | 168 +++++++++ ...tting_credentials_via_mimikatz_modules.yml | 157 ++++++++ ...ng_credentials_via_powersploit_modules.yml | 157 ++++++++ ...ocess_running_from_unexpected_location.yml | 345 ++++++++++++++++++ .../unusually_long_command_line.yml | 136 +++++++ .../wevtutil_usage_to_clear_logs.yml | 156 ++++++++ .../wevtutil_usage_to_disable_logs.yml | 151 ++++++++ 67 files changed, 10285 insertions(+), 51 deletions(-) create mode 100644 dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml create mode 100644 dist/ssa/detections/attempt_to_delete_services.yml create mode 100644 dist/ssa/detections/attempt_to_disable_services.yml create mode 100644 dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml create mode 100644 dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml create mode 100644 dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml create mode 100644 dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml create mode 100644 dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml create mode 100644 dist/ssa/detections/delete_a_net_user.yml create mode 100644 dist/ssa/detections/deny_permission_using_cacls_utility.yml create mode 100644 dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml create mode 100644 dist/ssa/detections/detect_kerberoasting.yml create mode 100644 dist/ssa/detections/detect_pass_the_hash.yml create mode 100644 dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml create mode 100644 dist/ssa/detections/disable_net_user_account.yml create mode 100644 dist/ssa/detections/first_time_seen_command_line_argument.yml create mode 100644 dist/ssa/detections/grant_permission_using_cacls_utility.yml create mode 100644 dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml create mode 100644 dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml create mode 100644 dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml create mode 100644 dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml create mode 100644 dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml create mode 100644 dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml create mode 100644 dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml create mode 100644 dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/rare_parent-child_process_relationship.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/resize_shadowstorage_volume.yml create mode 100644 dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml create mode 100644 dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml create mode 100644 dist/ssa/detections/setting_credentials_via_powersploit_modules.yml create mode 100644 dist/ssa/detections/system_process_running_from_unexpected_location.yml create mode 100644 dist/ssa/detections/unusually_long_command_line.yml create mode 100644 dist/ssa/detections/wevtutil_usage_to_clear_logs.yml create mode 100644 dist/ssa/detections/wevtutil_usage_to_disable_logs.yml diff --git a/bin/generate.py b/bin/generate.py index 910b1462af..cb7f4b13f0 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -92,6 +92,22 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH): return output_path +def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH): + ''' + @param detections: input list of individual YAML detections in detections/ directory + @return: the enhanced yaml file located in /detections directory + ''' + + # disable yaml pointers https://stackoverflow.com/questions/51272814/python-yaml-dumping-pointer-references + yaml.Dumper.ignore_aliases = lambda *args : True + + for d in detections: + manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml' + with open(manifest_file, 'w') as file: + documents = yaml.dump(d, file, sort_keys=True) + + return OUTPUT_PATH + '/detections/' + def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH): ''' @param detections: input list of individual YAML detections in detections/ directory @@ -113,19 +129,6 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P return output_path -# def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH): -# utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() - -# j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep -# trim_blocks=True) -# template = j2_env.get_template('analytic_stories.j2') -# output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf') -# output = template.render(stories=stories, time=utc_time) -# with open(output_path, 'w', encoding="utf-8") as f: -# f.write(output) - -# return output_path - def generate_use_case_library_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH): utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() @@ -245,7 +248,6 @@ def get_deployments(object, deployments): for tag_value_deployment in tag_array_deployment: if tag_value == tag_value_deployment: - # print("tag value: {}, matched deployment tag: {} on deployment: {}".format(tag_value,tag_value_deployment, deployment)) matched_deployments.append(deployment) continue @@ -257,9 +259,7 @@ def get_deployments(object, deployments): last_deployment = deployment else: last_deployment = matched_deployments[-1] - # last_deployment = replace_vars_in_deployment(last_deployment, object) # Not needed because of custom_jinja2_enrichment_filter - # print(last_deployment) return last_deployment def get_nes_fields(search, deployment): @@ -336,6 +336,15 @@ def add_annotations(detection): savedsearch_annotations[key] = detection['tags'][key] detection['savedsearch_annotations'] = savedsearch_annotations + # add SSA risk_severity + if 'risk_score' in detection['tags']: + if detection['tags']['risk_score'] >= 80: + detection['tags']['risk_severity'] = 'high' + elif(50>= detection['tags']['risk_score'] <=79): + detection['tags']['risk_severity'] = 'medium' + else: + detection['tags']['risk_severity'] = 'low' + return detection def add_rba(detection): @@ -433,7 +442,6 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH): elif detection['type'] == 'Correlation': detection['search'] = detection['search'] + ' | collect index=alerts' - # parse out data_models data_model = parse_data_models_from_search(detection['search']) if data_model: @@ -465,7 +473,7 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH): if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] - # turn all SAAWS detections + # enable all SAAWS detections if (OUTPUT_PATH) == 'dist/saaws': detection['disabled'] = 'false' @@ -626,14 +634,17 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH): objects["detections"] = [object for object in objects["detections"] if 'Dev Sec Ops Analytics' in object['tags']['product']] objects["stories"] = [object for object in objects["stories"] if 'Dev Sec Ops Analytics' in object['tags']['product']] + if PRODUCT == "ESCU": + # only use ESCU detections to the configurations + objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name']) + objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name']) - # only use ESCU detections to the configurations - objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name']) - # only use ESCU stories to the configuration - objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name']) + if PRODUCT == "SSA": + # only SSA detections, also no need to calculate stories + objects["detections"] = sorted(filter(lambda d: 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name']) + objects["stories"] = sorted(filter(lambda s: 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name']) objects["macros"] = sorted(objects["macros"], key=lambda m: m['name']) - objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], objects["playbooks"], OUTPUT_PATH) objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["playbooks"]) @@ -654,38 +665,38 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): try: if VERBOSE: print("generating Mitre lookups") - generate_mitre_lookup(OUTPUT_PATH) + # generate_mitre_lookup(OUTPUT_PATH) except Exception as e: print('Error: ' + str(e)) print("WARNING: Generation of Mitre lookup failed.") - lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) - lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) - lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH) - - detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) - - # story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) - - use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) - - macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) - - workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH) - # calculate deprecation totals deprecated = [] for d in objects['detections']: if 'deprecated' in d: deprecated.append(d) - if VERBOSE: - print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path)) - print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) - print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) - print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path)) - print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*")) - print("security content generation completed..") + if global_product == 'SSA': + detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) + if VERBOSE: + print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) + print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) + + else: + lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) + lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) + lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH) + detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) + use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) + macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) + workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH) + if VERBOSE: + print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path)) + print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) + print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) + print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path)) + print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*")) + print("security content generation completed..") if __name__ == "__main__": diff --git a/contentctl.py b/contentctl.py index c1e889c83d..8fef798c79 100644 --- a/contentctl.py +++ b/contentctl.py @@ -103,16 +103,13 @@ def main(args): # validate arguments validate_parser.set_defaults(func=validate, epilog=""" - Validates security manifest for correctness, adhering to spec and other common items. - VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""") + Validates security manifest for correctness, adhering to spec and other common items.""") # generate arguments - generate_parser.add_argument("-f", "--format", required=False, type=str, default="splunk_app", - help="Format of our deployment package, defaults to `splunk_app`.\n The deployment `splunk_app` runs on product Splunk Enterprise Security and Splunk Enterprise.") generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu", help="Path where to store the deployment package, defaults to `dist/escu`") - generate_parser.add_argument("--product", required=False, type=str, default="ESCU", - help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`") + generate_parser.add_argument("-p", "--product", required=False, type=str, default="ESCU", + help="Type of package to create, choose between `ESCU`, `DevSecOps`, `SAAWS`, or `SSA`. Defaults to `ESCU`") generate_parser.set_defaults(func=generate) # # parse them diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml new file mode 100644 index 0000000000..cc45d35518 --- /dev/null +++ b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml @@ -0,0 +1,181 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token + attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 759a653f-cb92-40f9-94c9-ec4e47b0f709 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1068 + - T1078 + - T1098 + - T1134 + - T1543 + - T1547 + - T1548 + - T1554 + - T1556 + - T1558 + nist: + - PR.AC + - PR.IP +name: Applying Stolen Credentials via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +- https://adsecurity.org/?p=1275 +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is violating authentication processes by injecting + golden or silver Kerberos tickets or passing stolen authentication tokens. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1068 + - T1078 + - T1098 + - T1134 + - T1543 + - T1547 + - T1548 + - T1554 + - T1556 + - T1558 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, + /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true + OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is violating authentication processes by injecting golden + or silver Kerberos tickets or passing stolen authentication tokens. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1055 + - T1068 + - T1078 + - T1098 + - T1134 + - T1543 + - T1547 + - T1548 + - T1554 + - T1556 + - T1558 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml new file mode 100644 index 0000000000..64b347ee77 --- /dev/null +++ b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml @@ -0,0 +1,185 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Stolen credentials are applied by methods such as user impersonation, + credential injection, spoofing of authentication processes or getting hold of critical + accounts. This detection indicates such activities carried out by PowerSploit exploit + kit APIs. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 270b482d-2af2-448f-9923-9cf005f61be4 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1068 + - T1078 + - T1098 + - T1134 + - T1543 + - T1547 + - T1548 + - T1554 + - T1555 + - T1558 + nist: + - PR.AC + - PR.IP +name: Applying Stolen Credentials via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is violating authentication by injecting stolen + credentials, manipulating authentication tokens or impersonating system or user + accounts. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1068 + - T1078 + - T1098 + - T1134 + - T1543 + - T1547 + - T1548 + - T1554 + - T1555 + - T1558 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true + OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, + /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is violating authentication by injecting stolen credentials, + manipulating authentication tokens or impersonating system or user accounts. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1055 + - T1068 + - T1078 + - T1098 + - T1134 + - T1543 + - T1547 + - T1548 + - T1554 + - T1555 + - T1558 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml new file mode 100644 index 0000000000..c419b6a6ce --- /dev/null +++ b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml @@ -0,0 +1,161 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: This detection identifies use of DSInternals modules that verify password + strength, i.e., identify week accounts that would be easily compromised. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1098 + - T1087 + - T1201 + - T1552 + - T1555 + nist: + - PR.AC + - PR.IP +name: Assessment of Credential Strength via DSInternals modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/MichaelGrafnetter/DSInternals +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 25 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. + Account attempting this operation is $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 16 + - CIS 20 + confidence: 85 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 30 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1098 + - T1087 + - T1201 + - T1552 + - T1555 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Test-PasswordQuality/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 85 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 30 + kill_chain_phases: + - Actions on Objectives + message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. + Account attempting this operation is $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1078 + - T1098 + - T1087 + - T1201 + - T1552 + - T1555 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 25 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/attempt_to_delete_services.yml new file mode 100644 index 0000000000..8cb68ebd61 --- /dev/null +++ b/dist/ssa/detections/attempt_to_delete_services.yml @@ -0,0 +1,109 @@ +author: Teoderick Contreras, splunk +datamodel: +- Endpoint +date: '2021-06-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic identifies suspicious series of attempt to kill multiple + services on a system using either `net.exe` or `sc.exe`. This technique is use by + adversaries to terminate security services or other related services to continue + there objective and evade detections. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +id: a0c8c292-d01a-11eb-aa18-acde48001122 +known_false_positives: unknown +mappings: + cis20: + - CIS 8 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.DS + - PR.IP +name: Attempt To delete Services +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +risk: [] +savedsearch_annotations: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 8 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.DS + - PR.IP +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 8 + - CIS 13 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + nist: + - PR.DS + - PR.IP + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_severity: high + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/attempt_to_disable_services.yml new file mode 100644 index 0000000000..7c2bd3edc6 --- /dev/null +++ b/dist/ssa/detections/attempt_to_disable_services.yml @@ -0,0 +1,111 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic will identify suspicious series of command-line to disable + several services. This technique is seen where the adversary attempts to disable + security app services or other malware services to complete the objective on the + compromised system. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +id: afb31de4-d023-11eb-98d5-acde48001122 +known_false_positives: unknown +mappings: + cis20: + - CIS 9 + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.DS + - PR.IP +name: Attempt To Disable Services +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +risk: [] +savedsearch_annotations: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 9 + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.DS + - PR.IP +search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, + "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") + AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 9 + - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + nist: + - PR.DS + - PR.IP + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_severity: medium + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml new file mode 100644 index 0000000000..8fc72d65c7 --- /dev/null +++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -0,0 +1,150 @@ +author: Jose Hernandez, Splunk +datamodel: [] +date: 2020-6-04 +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Monitor for execution of reg.exe with parameters specifying an export + of keys that contain hashed credentials that attackers may try to crack offline. +how_to_implement: You must be ingesting windows endpoint data that tracks process + activity, including parent-child relationships from your endpoints. +id: 14038953-e5f2-4daf-acff-5452062baf03 +known_false_positives: None identified. +mappings: + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - DE.CM +name: Attempted Credential Dump From Registry via Reg exe +product: +- Splunk Behavioral Analytics +references: +- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Malicious actor is dumping stored credentials from the registry sections + SAM, Security, or System. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" + OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true + AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, + /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time + = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) + | into write_ssa_detected_events(); ' +tags: + analytic_story: + - Credential Dumping + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is dumping stored credentials from the registry sections + SAM, Security, or System. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml new file mode 100644 index 0000000000..20eee0916c --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml @@ -0,0 +1,158 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. FGdump is + a newer version of pwdump tool that extracts NTLM and LanMan password hashes from + Windows. Cachedump is a publicly-available tool that extracts cached password hashes + from a system's registry. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 312582f2-5e91-42c1-a275-cd67f31373c8 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction indicative of FGDump and CacheDump with s option +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Unusual Processes + - Credential Dumping + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND parent_process_name != null + AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, + /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true + AND match_regex(cmd_line, /(?i)\-s/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Unusual Processes + - Credential Dumping + asset_type: Windows + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml new file mode 100644 index 0000000000..b44bd8d721 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml @@ -0,0 +1,155 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. FGdump is + a newer version of pwdump tool that extracts NTLM and LanMan password hashes from + Windows. Cachedump is a publicly-available tool that extracts cached password hashes + from a system's registry. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction indicative of FGDump and CacheDump with v option +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Unusual Processes + - Credential Dumping + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, + /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true + AND match_regex(cmd_line, /(?i)\-v/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Unusual Processes + - Credential Dumping + asset_type: Windows + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml new file mode 100644 index 0000000000..5e6d61ccf0 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml @@ -0,0 +1,150 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. LaZagne is + a tool that extracts various kinds of credentials from a local computer, including + account passwords, domain passwords, browser passwords, etc. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 341975fa-4ad0-4f01-9acc-df4f69742db7 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + - T1555 + nist: + - PR.IP + - PR.AC +name: Credential Extraction indicative of Lazagne command line options +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + - T1555 + nist: + - PR.IP + - PR.AC + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, + /(?i)all\s+\-oA\s+\-output/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + asset_type: Windows + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Lazagne malware is extracting/decoding encoded credentials. Operation is + performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ + mitre_attack_id: + - T1003 + - T1555 + nist: + - PR.IP + - PR.AC + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml new file mode 100644 index 0000000000..0f1da47b83 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml @@ -0,0 +1,161 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. DSInternals + is a collection of PowerShell modules commonly employed in exploits. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction indicative of use of DSInternals credential conversion + modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/MichaelGrafnetter/DSInternals +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: DSInternals tool kit is converting stolen credential material to a form + applicable to authentications. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Malicious PowerShell + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, + "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true + OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, + /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true + OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, + /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true + OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, + /(?i)ConvertTo-UnicodePassword/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell + asset_type: Windows + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: DSInternals tool kit is converting stolen credential material to a form + applicable to authentications. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml new file mode 100644 index 0000000000..5df5b95af6 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml @@ -0,0 +1,164 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. DSInternals + is a collection of PowerShell modules commonly employed in exploits. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction indicative of use of DSInternals modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/MichaelGrafnetter/DSInternals +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: DSInternals tool kit is accessing sensitive credential material such + as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Malicious PowerShell + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, + "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true + OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, + /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true + OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, + /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true + OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true + OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true + OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, + /(?i)Get-SamPasswordPolicy/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell + asset_type: Windows + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: DSInternals tool kit is accessing sensitive credential material such as + KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml new file mode 100644 index 0000000000..9886257714 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml @@ -0,0 +1,154 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. Mimikatz + is a collection of tools and modules commonly employed in Windows exploits. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction indicative of use of Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 66 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores + such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Unusual Processes + cis20: + - CIS 16 + confidence: 95 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true + OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true + OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true + OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true + OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Unusual Processes + asset_type: Windows + cis20: + - CIS 16 + confidence: 95 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is extracting/decoding encoded credentials from stores + such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 66 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml new file mode 100644 index 0000000000..ee6f7d13a5 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml @@ -0,0 +1,155 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. PowerSploit + is a collection of Microsoft PowerShell modules commonly employed in exploits. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 5f1186a4-e681-446e-851c-dc9574ad28eb +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction indicative of use of PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated + logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Malicious PowerShell + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true + OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true + OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, + /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true + OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, + /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell + asset_type: Windows + cis20: + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is extracting encoded credentials or spoofing automated + logings. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml new file mode 100644 index 0000000000..a93b2f8aef --- /dev/null +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml @@ -0,0 +1,159 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. Native Microsoft + debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential + material directly from memory and process dumps. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: c20bb8ec-e1b0-4640-b0ef-3a4c54f8c112 +known_false_positives: Although unlikely, using debuggers this way may be indicative + of developers analyzing crash dumps of their code. Note, even for developers this + is an unusual way of working on code - debuggers are mostly used to step through + code, not analyze its crash dumps. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.IP + - PR.AC +name: Credential Extraction native Microsoft debuggers peek into the kernel +product: +- Splunk Behavioral Analytics +references: +- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29 +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's + native debugging tools. Operation is performed at the device $dest_device_id$, by + the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Unusual Processes + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.IP + - PR.AC + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line != null AND parent_process_name != null AND process_name + != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, + /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true + AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Unusual Processes + asset_type: Windows + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is extracting/decoding encoded credentials via Microsoft's + native debugging tools. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.IP + - PR.AC + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml new file mode 100644 index 0000000000..350a3310d2 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml @@ -0,0 +1,155 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. Native Microsoft + debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential + material directly from memory and process dumps. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: adc51a77-90c9-4358-b43c-f10dd1a27d05 +known_false_positives: Although unlikely, using debuggers this way may be indicative + of developers analyzing crash dumps of their code. Note, even for developers this + is an unusual way of working on code - debuggers are mostly used to step through + code, not analyze its crash dumps. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP +name: Credential Extraction native Microsoft debuggers via z command line option +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's + native debugging tools. Operation is performed at the device $dest_device_id$, by + the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Unusual Processes + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name, + /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, + /(?i)\-z\s+/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Unusual Processes + asset_type: Windows + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is extracting/decoding encoded credentials via Microsoft's + native debugging tools. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml new file mode 100644 index 0000000000..20e91c8368 --- /dev/null +++ b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml @@ -0,0 +1,150 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-10-18' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: Credential extraction is often an illegal recovery of credential material + from secured authentication resources and repositories. This process may also involve + decryption or other transformations of the stored credential material. PowerSploit + and DSInternals are common exploit APIs offering PowerShell modules for various + exploits of Windows and Active Directory environments. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.IP + - PR.AC +name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and + DSInternals +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount + module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + - Malicious PowerShell + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003 + nist: + - PR.IP + - PR.AC + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, + /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell + asset_type: Windows + cis20: + - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount + module. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.IP + - PR.AC + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/delete_a_net_user.yml new file mode 100644 index 0000000000..bf0da7f982 --- /dev/null +++ b/dist/ssa/detections/delete_a_net_user.yml @@ -0,0 +1,112 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic will detect a suspicious net.exe/net1.exe command-line + to delete a user on a system. This technique may be use by an administrator for + legitimate purposes, however this behavior has been used in the wild to impair some + user or deleting adversaries tracks created during its lateral movement additional + systems. During triage, review parallel processes for additional behavior. Identify + any other user accounts created before or after. +how_to_implement: o successfully implement this search, you need to be ingesting logs + with the process name, parent process, and command-line executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed net.exe may be used. +id: 8776d79c-d26e-11eb-9a56-acde48001122 +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +mappings: + cis20: + - CIS 4 + - CIS 16 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.AC + - PR.IP +name: Delete A Net User +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +risk: [] +savedsearch_annotations: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 4 + - CIS 16 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.AC + - PR.IP +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 4 + - CIS 16 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + nist: + - PR.AC + - PR.IP + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_severity: high + security_domain: endpoint +type: Anomaly +version: 2 diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/deny_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..b1d897652a --- /dev/null +++ b/dist/ssa/detections/deny_permission_using_cacls_utility.yml @@ -0,0 +1,147 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-14' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic identifies a potential adversary that changes the security + permission of a specific file or directory. This technique is commonly seen in APT + tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection + and prevent access to their component files. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +id: b76eae28-cd25-11eb-9c92-acde48001122 +known_false_positives: network administrator may use this windows utility but this + is not a common practice. +mappings: + cis20: + - CIS 14 + - CIS 16 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1222 + nist: + - PR.AC + - PR.IP +name: Deny Permission using Cacls Utility +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 35 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 35 +risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny + a permission of a file or directory in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - XMRig + cis20: + - CIS 14 + - CIS 16 + confidence: 70 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1222 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + cis20: + - CIS 14 + - CIS 16 + confidence: 70 + context: + - source:endpoint + - stage: Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A cacls process $process_name$ with commandline $cmd_line$ try to deny + a permission of a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 35 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml new file mode 100644 index 0000000000..707f596534 --- /dev/null +++ b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml @@ -0,0 +1,149 @@ +author: Jose Hernandez, Splunk +datamodel: [] +date: '2020-09-15' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: This search detects the memory of lsass.exe being dumped for offline + credential theft attack. +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including Windows command line logging. You can see how we test this with [Event + Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) + on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). +id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e +known_false_positives: None identified. +mappings: + cis20: + - CIS 8 + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003.003 + - T1003 + nist: + - DE.CM +name: Detect Dump LSASS Memory using comsvcs +product: +- Splunk Behavioral Analytics +references: +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Malicious actor is dumping encoded credentials via Microsoft's native + comsvc DLL. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 8 + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1003.003 + - T1003 + nist: + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, + "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), + "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, + /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = + timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, + "process_name", process_name, "process", process]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + asset_type: Endpoint + cis20: + - CIS 8 + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc + DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003.003 + - T1003 + nist: + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _tenant + - _time + - dest_device_id + - process + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/detect_kerberoasting.yml new file mode 100644 index 0000000000..ef38ab913b --- /dev/null +++ b/dist/ssa/detections/detect_kerberoasting.yml @@ -0,0 +1,152 @@ +author: Xiao Lin, Splunk +datamodel: [] +date: '2020-10-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Patrick Bareiss + date: '2021-01-13' + description: Example for a deployment for a specific Analytics Story + id: 52f52a7c-078f-4413-84da-388b61ccac26 + name: Credential Dumping Story + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: Credential Dumping +description: This search detects a potential kerberoasting attack via service principal + name requests +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +id: dabdd6d7-3e10-42be-8711-4e124f7a3850 +known_false_positives: Older systems that support kerberos RC4 by default NetApp may + generate false positives +mappings: + cis20: + - CIS 8 + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1558.003 + - T1558 + nist: + - DE.CM +name: Detect Kerberoasting +product: +- Splunk Behavioral Analytics +references: +- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 14 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Credential Dumping + cis20: + - CIS 8 + - CIS 16 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1558.003 + - T1558 + nist: + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), + EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, + "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), + ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, + "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" + AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event + input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] + | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID + | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, + "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, + "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();' +tags: + analytic_story: + - Credential Dumping + cis20: + - CIS 8 + - CIS 16 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Kerberoasting malware is potentially applying stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1558.003 + - T1558 + nist: + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - service_name + - _time + - event_code + - ticket_encryption_type + - service_id + - ticket_options + risk_score: 14 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/detect_pass_the_hash.yml new file mode 100644 index 0000000000..197806c9e7 --- /dev/null +++ b/dist/ssa/detections/detect_pass_the_hash.yml @@ -0,0 +1,166 @@ +author: Xiao Lin, Splunk +datamodel: [] +date: '2020-10-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This search looks for specific authentication events from the Windows + Security Event logs to detect potential attempts using Pass-the-Hash technique. +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f +known_false_positives: Legitimate logon activity by authorized NTLM systems may be + detected by this search. Please investigate as appropriate. +mappings: + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP +name: Detect Pass the Hash +product: +- Splunk Behavioral Analytics +references: +- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 16 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Potential use of the pass the hash/token attacks that spoof authentication. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Lateral Movement + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event, + "authentication_type"), authentication_method=map_get(input_event, "authentication_method"), + origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9" + AND authentication_method="seclogo") + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, + "authentication_method", authentication_method]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Lateral Movement + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: Potential use of the pass the hash/token attacks that spoof authentication. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - signature_id + - authentication_type + - _time + - authentication_method + - origin_device_domain + - dest_user_id + - dest_device_id + risk_score: 16 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml new file mode 100644 index 0000000000..426de847da --- /dev/null +++ b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml @@ -0,0 +1,162 @@ +author: Ignacio Bermudez Corrales, Splunk +datamodel: [] +date: 2020-7-13 +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This search looks for executions of cmd.exe spawned by a process that + is often abused by attackers and that does not typically launch cmd.exe. This is + a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` + by @bpatel. +how_to_implement: You must be ingesting sysmon logs. This search has been modified + to process raw sysmon data from attack_range's nxlogs on DSP. +id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 +known_false_positives: There are circumstances where an application may legitimately + execute and interact with the Windows command-line interface. Investigate and modify + the lookup file, as appropriate. +mappings: + cis20: + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1059 + nist: + - PR.PT + - DE.CM +name: Detect Prohibited Applications Spawning cmd exe +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 56 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Potential malicious landing to the console via unexpected programs that + called cmd.exe. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. +savedsearch_annotations: + analytic_story: + - Suspicious Command-Line Executions + - Suspicious MSHTA Activity + - Suspicious Zoom Child Processes + - Sunburst Malware + cis20: + - CIS 8 + confidence: 80 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 70 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), + parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", + null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) + + | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" + | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" + OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" + OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" + OR field0="java.exe" OR field0="powershell.exe" + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, + "parent_process_name", parent_process]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Suspicious Command-Line Executions + - Suspicious MSHTA Activity + - Suspicious Zoom Child Processes + - Sunburst Malware + cis20: + - CIS 8 + confidence: 80 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential malicious landing to the console via unexpected programs that + called cmd.exe. Operation is performed at the device $dest_device_id$, by the + account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + risk_score: 56 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/disable_net_user_account.yml new file mode 100644 index 0000000000..75d483d560 --- /dev/null +++ b/dist/ssa/detections/disable_net_user_account.yml @@ -0,0 +1,111 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic will identify a suspicious command-line that disables a + user account using the `net.exe` utility native to Windows. This technique may used + by the adversaries to interrupt availability of such users to do their malicious + act. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be + used. +id: ba858b08-d26c-11eb-af9b-acde48001122 +known_false_positives: network operator may use this approach to quickly disable an + account but not a common practice. +mappings: + cis20: + - CIS 4 + - CIS 16 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.AC + - PR.IP +name: Disable Net User Account +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +risk: [] +savedsearch_annotations: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 4 + - CIS 16 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.AC + - PR.IP +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + - Ransomware + cis20: + - CIS 4 + - CIS 16 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + nist: + - PR.AC + - PR.IP + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_severity: medium + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/first_time_seen_command_line_argument.yml new file mode 100644 index 0000000000..b667e6a13c --- /dev/null +++ b/dist/ssa/detections/first_time_seen_command_line_argument.yml @@ -0,0 +1,157 @@ +author: Ignacio Bermudez Corrales, Splunk +datamodel: [] +date: 2021-2-1 +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This search looks for command-line arguments that use a `/c` parameter + to execute a command that has not previously been seen. This is an implementation + on SPL2 of the rule `First time seen command line argument` by @bpatel. +how_to_implement: You must be populating the endpoint data model for SSA and specifically + the process_name and the process fields +id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 +known_false_positives: Legitimate programs can also use command-line arguments to + execute. Please verify the command-line arguments to check what command/program + is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` + macro to exclude legitimate parent_process_name +mappings: + cis20: + - CIS 3 + - CIS 8 + kill_chain_phases: + - Command and Control + - Actions on Objectives + mitre_attack: + - T1059 + - T1117 + - T1202 + nist: + - PR.PT + - DE.CM + - PR.IP +name: First time seen command line argument +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 30 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 30 +risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute + command has not previously seen in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Unusual Processes + cis20: + - CIS 3 + - CIS 8 + confidence: 60 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Command and Control + - Actions on Objectives + mitre_attack: + - T1059 + - T1117 + - T1202 + nist: + - PR.PT + - DE.CM + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), + "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), + cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, + "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, + "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" + */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), + /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, + /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) | + where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* + \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, + dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm + | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Unusual Processes + cis20: + - CIS 3 + - CIS 8 + confidence: 60 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Command and Control + - Actions on Objectives + message: A cmd process $process_name$ with commandline $cmd_line$ try to execute + command has not previously seen in host $dest_device_id$ + mitre_attack_id: + - T1059 + - T1117 + - T1202 + nist: + - PR.PT + - DE.CM + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 30 + risk_severity: medium + security_domain: endpoint +type: Anomaly +version: 3 diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/grant_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..79b30217aa --- /dev/null +++ b/dist/ssa/detections/grant_permission_using_cacls_utility.yml @@ -0,0 +1,147 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-14' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic identifies potential adversaries that modify the security + permission of a specific file or directory. This technique is commonly seen in APT + tradecraft, ransomware and coinminer scripts to evade detections and restrict access + to their component files. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +id: c6da561a-cd29-11eb-ae65-acde48001122 +known_false_positives: network administrator may use this windows utility but this + is not a common practice. +mappings: + cis20: + - CIS 14 + - CIS 16 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1222 + nist: + - PR.AC + - PR.IP +name: Grant Permission Using Cacls Utility +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 35 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 35 +risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant + user a permission to a file or directory in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - XMRig + cis20: + - CIS 14 + - CIS 16 + confidence: 70 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1222 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + cis20: + - CIS 14 + - CIS 16 + confidence: 70 + context: + - source:endpoint + - stage: Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A cacls process $process_name$ with commandline $cmd_line$ try to grant + user a permission to a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 35 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml new file mode 100644 index 0000000000..f710887623 --- /dev/null +++ b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml @@ -0,0 +1,166 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that enable illegaly + access user content, such as key logging, audio recording, screenshots, tapping + into http and RDP sessions, etc. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 01fc7d91-eb0c-478e-8633-e4fa4904463a +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1113 + - T1123 + - T1563 + nist: + - PR.AC + - PR.IP +name: Illegal Access To User Content via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 85 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is tapping into user content - microphone, camera, + ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Malicious PowerShell + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Exfiltration + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 85 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1113 + - T1123 + - T1563 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR + match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true + OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, + /(?i)Get-WebConfig/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Malicious PowerShell + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Exfiltration + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log + impact: 85 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is tapping into user content - microphone, camera, + ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1021 + - T1113 + - T1123 + - T1563 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 85 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml new file mode 100644 index 0000000000..f0cba48987 --- /dev/null +++ b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml @@ -0,0 +1,150 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that create accounts + illegaly. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 20fba62a-fa5b-46cc-b39f-473fa248fee2 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1585 + nist: + - PR.AC + - PR.IP +name: Illegal Account Creation via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is creating illegal domain accounts. Operation is + performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Persistence + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1585 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)New-DomainUser/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Persistence + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is creating illegal domain accounts. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1585 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml new file mode 100644 index 0000000000..0e0886d920 --- /dev/null +++ b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml @@ -0,0 +1,151 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that delete event + logs. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1070 + nist: + - PR.AC + - PR.IP +name: Illegal Deletion of Logs via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 50 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious + activity. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Log Manipulation + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 50 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1070 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Log Manipulation + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1070 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 50 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml new file mode 100644 index 0000000000..951cb37e77 --- /dev/null +++ b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml @@ -0,0 +1,155 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of DSInternals modules that enable or disable + accounts illegaly. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 3e0f9962-9989-445f-878c-939443326b63 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP +name: Illegal Enabling or Disabling of Accounts via DSInternals modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/MichaelGrafnetter/DSInternals +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: DSInternals malware is illegally enabling or disabling accounts. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml new file mode 100644 index 0000000000..399bc29caa --- /dev/null +++ b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml @@ -0,0 +1,160 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of DSInternals modules for illegal management + of Active Directoty elements and policies. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: a587ca9f-c138-47b4-ba51-699f319b8cc5 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1098 + - T1207 + - T1484 + nist: + - PR.AC + - PR.IP +name: Illegal Management of Active Directory Elements and Policies via DSInternals + modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/MichaelGrafnetter/DSInternals +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: DSInternals malware is controlling infrastructure by modifying Active + Directory elements, domain controllers, and policies. Operation is performed at + the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1098 + - T1207 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true + OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, + /(?i)Set-LsaPolicyInformation/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: DSInternals malware is controlling infrastructure by modifying Active Directory + elements, domain controllers, and policies. Operation is performed at the device + $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1098 + - T1207 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml new file mode 100644 index 0000000000..949a8f9c79 --- /dev/null +++ b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml @@ -0,0 +1,161 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that enable illegal + management of computers and Active Directory elements. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 75760c11-7d48-4968-b828-013b299e8f6d +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1098 + - T1207 + - T1484 + nist: + - PR.AC + - PR.IP +name: Illegal Management of Computers and Active Directory Elements via PowerSploit + modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is controlling infrastructure by modifying Active + Directory elements or local Master Boot Records. Operation is performed at the device + $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1098 + - T1207 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR + match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, + /(?i)Set-MasterBootRecord/)=true ) + + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is controlling infrastructure by modifying Active Directory + elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1098 + - T1207 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml new file mode 100644 index 0000000000..96a76208ab --- /dev/null +++ b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -0,0 +1,166 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that illegaly + elevate general privileges or ensure persistence, e.g., enable manipulation of registry, + task scheduling, persistent WMI, access to OS objects under desired identities. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 88c10ee9-fe72-4bce-b343-5b129044b991 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1053 + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP +name: Illegal Privilege Elevation and Persistence via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is planting attack persistence elements, altering + privileges and access controls. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Malicious PowerShell + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Command And Control + - Stage:Persistence + - Consequence:Loss Of Control + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1053 + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true + OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true + OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Malicious PowerShell + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Command And Control + - Stage:Persistence + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is planting attack persistence elements, altering privileges + and access controls. Operation is performed at the device $dest_device_id$, by + the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1053 + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml new file mode 100644 index 0000000000..04a239f103 --- /dev/null +++ b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml @@ -0,0 +1,157 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for illegal privilege + elevation. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 2f873b1f-6352-4844-b7b9-b419f09a42c7 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP +name: Illegal Privilege Elevation via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is setting highest privileges to malicious entities. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Privilege Escalation + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Privilege Escalation + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is setting highest privileges to malicious entities. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml new file mode 100644 index 0000000000..5e2fe5e498 --- /dev/null +++ b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml @@ -0,0 +1,160 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for illegal control + over services and processes, including the authentication service. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: aaf3adf1-73e1-4477-b4ee-3771898964f1 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1106 + - T1569 + nist: + - PR.AC + - PR.IP +name: Illegal Service and Process Control via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is controlling computer's processess and services. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Service Abuse + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1106 + - T1569 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, + /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, + /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true + OR match_regex(cmd_line, /(?i)misc::memssp/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Service Abuse + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is controlling computer's processess and services. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1055 + - T1106 + - T1569 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml new file mode 100644 index 0000000000..477c3ba9b4 --- /dev/null +++ b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml @@ -0,0 +1,171 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-09' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that enable illegal + control of services and processes, such as installing or spoofing of malicious services, + injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, + modifying access to service objects, etc. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 0e910e5b-309d-4bc3-8af2-0030c02aa353 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1106 + - T1569 + nist: + - PR.AC + - PR.IP +name: Illegal Service and Process Control via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is controlling computer's processess and services. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Service Abuse + - Malicious PowerShell + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1055 + - T1106 + - T1569 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true + OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, + /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true + OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, + /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true + OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, + /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true + OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, + /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true + ) + + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Service Abuse + - Malicious PowerShell + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is controlling computer's processess and services. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1055 + - T1106 + - T1569 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml new file mode 100644 index 0000000000..4ed844eb1a --- /dev/null +++ b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml @@ -0,0 +1,132 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-15' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This analytic identifies suspicious modification of ACL permission to + a files or folder to make it available to everyone or to a specific user. This technique + may be used by the adversary to evade ACLs or protected files access. This changes + is commonly configured by the file or directory owner with appropriate permission. + This behavior is a good indicator if this command seen on a machine utilized by + an account with no permission to do so. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +id: 9ae9a48a-cdbe-11eb-875a-acde48001122 +known_false_positives: network administrator may use this windows utility. filter + is needed. +mappings: + kill_chain_phases: + - Exploitation + mitre_attack: + - T1222 +name: Modify ACLs Permission Of Files Or Folders +product: +- Splunk Behavioral Analytics +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 35 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 35 +risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify + a permission of a file or directory in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - XMRig + confidence: 70 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1222 + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, + /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" + OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +tags: + analytic_story: + - XMRig + confidence: 70 + context: + - source:endpoint + - stage: Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A cacls process $process_name$ with commandline $cmd_line$ try to modify + a permission of a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 35 + risk_severity: medium + security_domain: endpoint +type: Anomaly +version: 1 diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml new file mode 100644 index 0000000000..79e77dfec0 --- /dev/null +++ b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml @@ -0,0 +1,160 @@ +author: Ignacio Bermudez Corrales, Splunk +datamodel: [] +date: '2020-08-25' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: Attacker activity may compromise executing several LOLBAS applications + in conjunction to accomplish their objectives. We are looking for more than usual + LOLBAS applications over a window of time, by building profiles per machine. +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 +known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS + applications in a short period of time. This might trigger false positives at the + beginning when it hasn''t collected yet enough data to construct the baseline. + + ' +mappings: + cis20: + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1059 + - T1053 + nist: + - PR.PT + - DE.CM +name: More than usual number of LOLBAS applications in short time period +product: +- Splunk Behavioral Analytics +references: +- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 25 +- threat_object_field: process_name + threat_object_type: processname +risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin + short period of time in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Unusual Processes + cis20: + - CIS 8 + confidence: 50 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1059 + - T1053 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: process_name + role: + - Others + type: processname +search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" + OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" + OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" + OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" + OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" + OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" + OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" + OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" + OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" + OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" + OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" + OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" + OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" + OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" + OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" + OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" + OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" + OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" + OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" + OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" + OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR + process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" + OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" + OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" + OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" + OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by + device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end + as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" + window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, + end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", + lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Unusual Processes + cis20: + - CIS 8 + confidence: 50 + context: + - source:endpoint + - stage: Defense Evasion + impact: 50 + kill_chain_phases: + - Exploitation + message: A system process $process_name$ with commandline $cmd_line$ spawn iin short + period of time in host $dest_device_id$ + mitre_attack_id: + - T1059 + - T1053 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: process_name + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - _time + - process_name + risk_score: 25 + risk_severity: medium + security_domain: endpoint +type: Anomaly +version: 2 diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml new file mode 100644 index 0000000000..db7700693f --- /dev/null +++ b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml @@ -0,0 +1,105 @@ +author: Xiao Lin, Splunk +datamodel: [] +date: '2020-08-25' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: Malicious mails can conduct phishing that induces readers to open attachment, + click links or trigger third party service. This detect uses Natural Language Processing + (NLP) approach to analyze an email message's content (Sender, Subject and Body) + and judge whether it is a phishing email. The detection adopts a deep learning (neural + network) model that employs character level embeddings plus LSTM layers to perform + classification. The model is pre-trained and then published as ONNX format. Current + sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json + User are expected to re-train the model by combining with their own training data + for better accuracy using the provided model file (SMLE notebook). DSP pipeline + then processes the email message and passes it as an event to Apply ML Models function, + which returns the probability of a phishing email. Current implementation assumes + the email is fed to DSP in JSON format contains at least email's sender, subject + and its message body, including reply content, if any. +how_to_implement: Events are fed to DSP contains at least email's sender, subject + and its message body. +id: 4b237388-dfa1-41a6-91d4-4de2d598376f +known_false_positives: Because of imbalance of anomaly data in training, the model + will less likely report false positive. Instead, the model is more prone to false + negative. Current best recall score is ~85% +mappings: + cis20: + - CIS 8 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1566 + nist: + - PR.PT + - DE.CM +name: Phishing Email Detection by Machine Learning Method - SSA +product: +- Splunk Behavioral Analytics +references: [] +risk: [] +savedsearch_annotations: + cis20: + - CIS 8 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1566 + nist: + - PR.PT + - DE.CM +search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event, + "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " + "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), + _time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={" + ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, + ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, + "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, + ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, + "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, + "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, + "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, + "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": + 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": + 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": + 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in + = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, + 1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8" + path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out, + 0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD", + body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();' +tags: + cis20: + - CIS 8 + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1566 + nist: + - PR.PT + - DE.CM + product: + - Splunk Behavioral Analytics + risk_severity: low + security_domain: mail server +type: Anomaly +version: 1 diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml new file mode 100644 index 0000000000..19defdc846 --- /dev/null +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -0,0 +1,167 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2021-09-01' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies potential Pass the Token or Pass the Hash credential + exploits. We detect the main side effect of these attacks, which is a transition + from the dominant Kerberos logins to rare NTLM logins for a given user, as reported + by a detination device. +how_to_implement: You must be ingesting Windows Security logs from endpoint devices, + i.e., destinations of interest. Please make sure that event ID 4624 is being logged. +id: 82e76b80-5cdb-4899-9b43-85dbe777b36d +known_false_positives: Environments in which NTLM is used extremely rarely and for + benign purposes (such as a rare use of SMB shares). +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Lateral Movement + mitre_attack: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP +name: Potential Pass the Token or Hash Observed at the Destination Device +product: +- Splunk Behavioral Analytics +references: +- https://attack.mitre.org/techniques/T1550/002/ +risk: [] +risk_message: Potential lateral movement and credential stealing via Pass the Token + or Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the destination device $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Lateral Movement + cis20: + - CIS 16 + - CIS 20 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + impact: 80 + kill_chain_phases: + - Lateral Movement + mitre_attack: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Other + type: Hostname +search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, + "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), + "string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), + "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), + "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)) + + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND dest_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, + "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos", + totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", + endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime]) + + | into write_ssa_detected_events();' +tags: + analytic_story: + - Lateral Movement + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + impact: 80 + kill_chain_phases: + - Lateral Movement + message: Potential lateral movement and credential stealing via Pass the Token or + Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the destination device $dest_device_id$ + mitre_attack_id: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Other + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - dest_device_id + - authentication_method + risk_score: 72 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml new file mode 100644 index 0000000000..366ec7fda1 --- /dev/null +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -0,0 +1,169 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2021-09-01' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies potential Pass the Token or Pass the Hash credential + exploits. We detect the main side effect of these attacks, which is a transition + from the dominant Kerberos logins to rare NTLM logins for a given user, as reported + by an event-collecting device (i.e., a specific domain controller or an endpoint + destination). +how_to_implement: You must be ingesting Windows Security logs from devices of interest + - at least from domain controllers. Please make sure that event ID 4624 is being + logged. +id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 +known_false_positives: Environments in which NTLM is used extremely rarely and for + benign purposes (such as a rare use of SMB shares). +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Lateral Movement + mitre_attack: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP +name: Potential Pass the Token or Hash Observed by an Event Collecting Device +product: +- Splunk Behavioral Analytics +references: +- https://attack.mitre.org/techniques/T1550/002/ +risk: [] +risk_message: Potential lateral movement and credential stealing via Pass the Token + or Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the logging device $origin_device_id$ +savedsearch_annotations: + analytic_story: + - Lateral Movement + cis20: + - CIS 16 + - CIS 20 + confidence: 80 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + impact: 80 + kill_chain_phases: + - Lateral Movement + mitre_attack: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: origin_device_id + role: + - Other + type: Hostname +search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, + "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), + "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), + "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), + "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)) + + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND origin_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, + origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm", + totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time", + startNTLMTime, "detection_end_time", endNTLMTime]) + + | into write_ssa_detected_events();' +tags: + analytic_story: + - Lateral Movement + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 80 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + impact: 80 + kill_chain_phases: + - Lateral Movement + message: Potential lateral movement and credential stealing via Pass the Token or + Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the logging device $origin_device_id$ + mitre_attack_id: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: origin_device_id + role: + - Other + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - origin_device_id + - authentication_method + risk_score: 64 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml new file mode 100644 index 0000000000..17c05fc1f4 --- /dev/null +++ b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -0,0 +1,153 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-04' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of PowerSploit modules that facilitate + access probing with admin credentials as well as probing access to system services. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: d405af5d-99f1-45af-8dfb-b8f98b764247 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP +name: Probing Access with Stolen Credentials via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 60 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is probing access with stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Privilege Escalation + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 60 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true + OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Privilege Escalation + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 60 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is probing access with stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_user_id + - dest_device_id + risk_score: 60 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/rare_parent-child_process_relationship.yml new file mode 100644 index 0000000000..c9abcfe4e0 --- /dev/null +++ b/dist/ssa/detections/rare_parent-child_process_relationship.yml @@ -0,0 +1,138 @@ +author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk +datamodel: [] +date: '2021-05-20' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: An attacker may use LOLBAS tools spawned from vulnerable applications + not typically used by system administrators. This search leverages the Splunk Streaming + ML DSP plugin to find rare parent/child relationships. The list of application has + been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +id: cf090c78-bcc6-11eb-8529-0242ac130003 +known_false_positives: 'Some custom tools used by admins could be used rarely to launch + remotely applications. This might trigger false positives at the beginning when + it hasn''t collected yet enough data to construct the baseline. + + ' +mappings: + cis20: + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1203 + - T1059 + - T1053 + - T1072 + nist: + - PR.PT + - DE.CM +name: Rare Parent-Child Process Relationship +product: +- Splunk Behavioral Analytics +references: [] +risk: [] +savedsearch_annotations: + analytic_story: + - Unusual Processes + cis20: + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1203 + - T1059 + - T1053 + - T1072 + nist: + - PR.PT + - DE.CM +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, + "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, + "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, + timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" + target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" + OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" + OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" + OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" + OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" + OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" + OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" + OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" + OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" + OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" + OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" + OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" + OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" + OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" + OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" + OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" + OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" + OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" + OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" + OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" + OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" + OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR + process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" + OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" + OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" + OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") + | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 + window=604800000L | where label AND input > mean | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = + create_map(["process_name", process_name, "parent_process_name", parent_process_name, + "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", + cmd_line]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Unusual Processes + cis20: + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1203 + - T1059 + - T1053 + - T1072 + nist: + - PR.PT + - DE.CM + product: + - Splunk Behavioral Analytics + required_fields: + - process + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + risk_severity: low + security_domain: endpoint +type: Anomaly +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml new file mode 100644 index 0000000000..2ff6c7f862 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml @@ -0,0 +1,157 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-05' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for discovery of accounts + and groups and access to them. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is searching for and using specific accounts and groups. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is searching for and using specific accounts and groups. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml new file mode 100644 index 0000000000..820d6be3cd --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml @@ -0,0 +1,181 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-05' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that discover + accounts, groups and policies that can be accessed or taken over. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 63422f8e-766c-468f-8133-2ba6795e263b +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is searching for and using specific accounts, groups + and policies, such as the last logged on account, a local Net group, etc. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true + OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, + /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true + OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, + /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true + OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, + /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true + OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true + OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, + /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true + OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, + /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true + OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true + OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, + /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true + OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true + OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true + OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, + /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true + OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, + /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true + OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, + /(?i)Get-LastLoggedOn/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is searching for and using specific accounts, groups + and policies, such as the last logged on account, a local Net group, etc. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml new file mode 100644 index 0000000000..b6f27005e6 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml @@ -0,0 +1,174 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules for reconnaissance + and access to elements of Active Directory infrastructure, such as domain identifiers, + AD sites and forests, and trust relations. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: db08ac40-ee14-43e9-9a75-dddd059ef812 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1199 + - T1482 + - T1590 + - T1591 + - T1595 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit + modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is seaching for or accessing Active Directory objects + such as domain sites, domain trusts, AD forests, etc. Operation is performed at + the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1199 + - T1482 + - T1590 + - T1591 + - T1595 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR + match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true + OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true + OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, + /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true + OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true + OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true + OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, + /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true + OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is seaching for or accessing Active Directory objects + such as domain sites, domain trusts, AD forests, etc. Operation is performed at + the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1199 + - T1482 + - T1590 + - T1591 + - T1595 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml new file mode 100644 index 0000000000..45ef344b62 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml @@ -0,0 +1,162 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that discover + computers, servers and domains that can be accessed or taken over. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1592 + - T1590 + - T1087 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Computers and Domains via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is seaching for or accessing domain controllers, + computers, file servers, etc. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1592 + - T1590 + - T1087 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR + match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true + OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true + OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, + /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is seaching for or accessing domain controllers, computers, + file servers, etc. Operation is performed at the device $dest_device_id$, by the + account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1592 + - T1590 + - T1087 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml new file mode 100644 index 0000000000..7c4ed009d8 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml @@ -0,0 +1,147 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for discovery of computers + and servers and access to them. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1592 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Computers via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 50 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is collecting information about computers. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 50 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1592 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)net::ServerInfo/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is collecting information about computers. Operation is + performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ + mitre_attack_id: + - T1592 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 50 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml new file mode 100644 index 0000000000..5126b89eb0 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml @@ -0,0 +1,182 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that discover + and access operating system elements, such as processes, services, registry locations, + security packages and files. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1057 + - T1083 + - T1592.002 + - T1046 + - T1012 + - T1007 + - T1047 + - T1592 + - T1518 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Operating System Elements via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is searching for and tapping into ongoing processes, + mounted drives or other operating system elements. Operation is performed at the + device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1057 + - T1083 + - T1592.002 + - T1046 + - T1012 + - T1007 + - T1047 + - T1592 + - T1518 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true + OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, + /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR + match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true + OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true + OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, + /(?i)Get-RegistryMountedDrive/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is searching for and tapping into ongoing processes, + mounted drives or other operating system elements. Operation is performed at the + device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1057 + - T1083 + - T1592.002 + - T1046 + - T1012 + - T1007 + - T1047 + - T1592 + - T1518 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml new file mode 100644 index 0000000000..ee99f06077 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml @@ -0,0 +1,151 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for discovery and access + to services and processes. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 0243d37c-57c1-4182-bfd1-39b212255fc8 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1007 + - T1046 + - T1057 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Processes and Services via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 50 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is listing processes and services. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 50 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1007 + - T1046 + - T1057 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is listing processes and services. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1007 + - T1046 + - T1057 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 50 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml new file mode 100644 index 0000000000..52748df622 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml @@ -0,0 +1,160 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for discovery and access + to network shares. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Shared Resources via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is searching for and accessing network shares. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Lateral Movement + - Stage:Collection + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)net::share/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Lateral Movement + - Stage:Collection + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is searching for and accessing network shares. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml new file mode 100644 index 0000000000..ace88f6825 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml @@ -0,0 +1,164 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules that discover + and access network and distributed file system shares. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 6b7ca431-6b1e-4b40-9589-21cb368e369e +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP +name: Reconnaissance and Access to Shared Resources via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is searching for and accessing network shares. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Lateral Movement + - Stage:Collection + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true + OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, + /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true + OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, + /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Lateral Movement + - Stage:Collection + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is searching for and accessing network shares. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml new file mode 100644 index 0000000000..4dd8815e53 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -0,0 +1,177 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-05' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of PowerSploit modules that discover opportunities + for malicious access and persistence. Some examples include access to admin accounts, + weak access control policies, landing paths for dropping malicious software or data + to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities, + as well as services and system files that can be compromised. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1053 + - T1068 + - T1078 + - T1543 + - T1547 + - T1574 + nist: + - PR.AC + - PR.IP +name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 60 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is searching for an entry point into the infrastructure, + such as local admin accounts, opportunities to hijack processes, unattended install + files, or modifiable access objects. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 60 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1053 + - T1068 + - T1078 + - T1543 + - T1547 + - T1574 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true + OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, + /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true + OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, + /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true + OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, + /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true + OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, + /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true + OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, + /(?i)Get-UnquotedService/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 60 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is searching for an entry point into the infrastructure, + such as local admin accounts, opportunities to hijack processes, unattended install + files, or modifiable access objects. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1053 + - T1068 + - T1078 + - T1543 + - T1547 + - T1574 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 60 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml new file mode 100644 index 0000000000..4ee8fedbf5 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml @@ -0,0 +1,163 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies access to PowerSploit modules for reconnaissance + of connectivity. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP +name: Reconnaissance of Connectivity via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is performing port scans or searching for various + connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true + OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, + /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true + OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, + /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true + OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is performing port scans or searching for various connectivity + details such as DNS data, proxies, or ongoing RDP connections. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1021 + - T1039 + - T1135 + - T1021.002 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml new file mode 100644 index 0000000000..b8cd08eaa9 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml @@ -0,0 +1,172 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies reconnaissance of credential stores and use + of CryptoAPI services by Mimikatz modules. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 5facee5b-79e4-47ab-b0e6-c625acc0554f +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1098 + - T1590.001 + - T1078 + - T1589.001 + - T1590 + - T1068 + - T1589 + - T1590.003 + nist: + - PR.AC + - PR.IP +name: Reconnaissance of Credential Stores and Services via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is searching for and accessing credential stores. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1098 + - T1590.001 + - T1078 + - T1589.001 + - T1590 + - T1068 + - T1589 + - T1590.003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, + /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true + OR match_regex(cmd_line, /(?i)crypto::sc/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is searching for and accessing credential stores. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1098 + - T1590.001 + - T1078 + - T1589.001 + - T1590 + - T1068 + - T1589 + - T1590.003 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml new file mode 100644 index 0000000000..946bc254a4 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml @@ -0,0 +1,156 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-05' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of PowerSploit modules for assessment of + presence of defensive tools. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 24b4e659-63a2-4e7b-89ac-87dd659c7110 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1592.002 + - T1595.002 + - T1592 + - T1595 + nist: + - PR.AC + - PR.IP +name: Reconnaissance of Defensive Tools via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 40 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is looking for presence of anti virus software. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 40 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1592.002 + - T1595.002 + - T1592 + - T1595 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-AVSignature/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 40 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is looking for presence of anti virus software. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1592.002 + - T1595.002 + - T1592 + - T1595 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 40 + risk_severity: medium + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml new file mode 100644 index 0000000000..0c9dcb0a02 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -0,0 +1,153 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-05' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of PowerSploit modules for assessment of + privilege escalation opportunities. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: b9b4492c-2af8-449b-beb4-b1b78d963321 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP +name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 60 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is engaging its privilege escalation module. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 60 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Invoke-PrivescAudit/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 60 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is engaging its privilege escalation module. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 60 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml new file mode 100644 index 0000000000..1c935ced80 --- /dev/null +++ b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml @@ -0,0 +1,162 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-05' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies use of Mimikatz modules for discovery of process + or service hijacking opportunities via Microsoft Detours compatibility. Microsoft + Detours is an open source library for intercepting, monitoring and instrumenting + binary functions on Microsoft Windows. Detours intercepts Win32 functions by re-writing + the in-memory code for target functions. The Detours package also contains utilities + to attach arbitrary DLLs and data segments called payloads to any Win32 binary. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: fc5c1cbd-7494-4314-aad2-458d6fd4fada +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1543 + - T1055 + - T1574 + nist: + - PR.AC + - PR.IP +name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +- https://en.wikipedia.org/wiki/Microsoft_Detours +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 70 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package + that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Discovery Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1543 + - T1055 + - T1574 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)misc::detours/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Discovery Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is looking for and invoking Microsoft Detours package + that enables spoofing of in-memory code. Operation is performed at the device + $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1543 + - T1055 + - T1574 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: low + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/resize_shadowstorage_volume.yml new file mode 100644 index 0000000000..57ffdafbaf --- /dev/null +++ b/dist/ssa/detections/resize_shadowstorage_volume.yml @@ -0,0 +1,113 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-21' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: The following analytics identifies the resizing of shadowstorage by ransomware + malware to avoid the shadow volumes being made again. this technique is an alternative + by ransomware attacker than deleting the shadowstorage which is known alert in defensive + team. one example of ransomware that use this technique is CLOP ransomware where + it drops a .bat file that will resize the shadowstorage to minimum size as much + as possible +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +id: dbc30554-d27e-11eb-9e5e-acde48001122 +known_false_positives: network admin can resize the shadowstorage for valid purposes. +mappings: + cis20: + - CIS 10 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.DS + - PR.IP +name: Resize Shadowstorage Volume +product: +- Splunk Behavioral Analytics +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +risk: [] +savedsearch_annotations: + analytic_story: + - Clop Ransomware + - Ransomware + cis20: + - CIS 10 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1489 + nist: + - PR.DS + - PR.IP +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") + AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +tags: + analytic_story: + - Clop Ransomware + - Ransomware + cis20: + - CIS 10 + - CIS 13 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + nist: + - PR.DS + - PR.IP + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_severity: high + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml new file mode 100644 index 0000000000..6f0b603b48 --- /dev/null +++ b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml @@ -0,0 +1,168 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies illegal setting of credentials via DSInternals + modules. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP +name: Setting Credentials via DSInternals modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/MichaelGrafnetter/DSInternals +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: DSInternals malware is accessing, using or setting Active Directory + or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Source:Cloud Data + - Stage:Credential Access + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, + "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true + OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true + OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, + /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true + OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Source:Cloud Data + - Stage:Credential Access + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: DSInternals malware is accessing, using or setting Active Directory or + Azure credentials and accounts. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml new file mode 100644 index 0000000000..df0157fb77 --- /dev/null +++ b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml @@ -0,0 +1,157 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies illegal setting of credentials via Mimikatz + modules. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: c8b84699-7652-4363-910f-efd1ca82f780 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP +name: Setting Credentials via Mimikatz modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/gentilkiwi/mimikatz +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 80 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: Mimikatz malware is accessing, using or setting account credentials. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is accessing, using or setting account credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 80 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml new file mode 100644 index 0000000000..7c9d4b0d78 --- /dev/null +++ b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml @@ -0,0 +1,157 @@ +author: Stanislav Miskovic, Splunk +datamodel: [] +date: '2020-11-03' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This detection identifies illegal setting of credentials via PowerSploit + modules. +how_to_implement: You must be ingesting Windows Security logs from devices of interest, + including the event ID 4688 with enabled command line logging. +id: 07b2a501-f967-4ddc-9f56-2dce46dfce44 +known_false_positives: None identified. +mappings: + cis20: + - CIS 16 + - CIS 20 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP +name: Setting Credentials via PowerSploit modules +product: +- Splunk Behavioral Analytics +references: +- https://github.com/PowerShellMafia/PowerSploit +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 90 +- threat_object_field: cmd_line + threat_object_type: processname +risk_message: PowerSploit malware is setting passwords on Active Directory accounts. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ +savedsearch_annotations: + analytic_story: + - Windows Persistence Techniques + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control + impact: 90 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Set-DomainUserPassword/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is setting passwords on Active Directory accounts. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + role: + - Actor + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: cmd_line + role: + - Others + type: processname + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint +type: TTP +version: 1 diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/system_process_running_from_unexpected_location.yml new file mode 100644 index 0000000000..7722e2d723 --- /dev/null +++ b/dist/ssa/detections/system_process_running_from_unexpected_location.yml @@ -0,0 +1,345 @@ +author: Ignacio Bermudez Corrales, Splunk +datamodel: [] +date: '2020-08-25' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: An attacker tries might try to use different version of a system command + without overriding original, or they might try to avoid some detection running the + process from a different folder. This detection checks that a list of system processes + run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes + has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv + and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +id: 28179107-099a-464a-94d3-08301e6c055f +known_false_positives: None +mappings: + cis20: + - CIS 8 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1036 + nist: + - PR.PT + - DE.CM +name: System Process Running from Unexpected Location +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 56 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 56 +risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in + non-default folder path in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Windows Defense Evasion Tactics + - Masquerading - Rename System Utilities + cis20: + - CIS 8 + confidence: 80 + context: + - source:endpoint + - stage: Defense Evasion + impact: 70 + kill_chain_phases: + - Actions on Objectives + mitre_attack: + - T1036 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); + + $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" + OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" + OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" + OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" + OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" + OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" + OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" + OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" + OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" + OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR + process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR + process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" + OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR + process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" + OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" + OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR + process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" + OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" + OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" + OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" + OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" + OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" + OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" + OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" + OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" + OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR + process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" + OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" + OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" + OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" + OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" + OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" + OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" + OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" + OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" + OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" + OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; + + $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" + OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" + OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" + OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" + OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" + OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR + process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" + OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR + process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" + OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" + OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" + OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" + OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" + OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" + OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR + process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" + OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" + OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" + OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" + OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" + OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" + OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" + OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" + OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" + OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" + OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" + OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" + OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" + OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" + OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR + process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR + process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" + OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" + OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" + OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" + OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" + OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" + OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" + OR process_name="windowsanytimeupgraderesults.exe"; + + $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR + process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" + OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" + OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" + OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" + OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" + OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" + OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" + OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" + OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" + OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" + OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" + OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" + OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" + OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" + OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" + OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" + OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" + OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" + OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" + OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" + OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" + OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" + OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" + OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" + OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" + OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" + OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" + OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" + OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" + OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" + OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" + OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" + OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" + OR process_name="easinvoker.exe" OR process_name="efsui.exe"; + + $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" + OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" + OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" + OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" + OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" + OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" + OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" + OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" + OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" + OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" + OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" + OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" + OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" + OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" + OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" + OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" + OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" + OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" + OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" + OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" + OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" + OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" + OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" + OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" + OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" + OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" + OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" + OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" + OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" + OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" + OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" + OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" + OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" + OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; + + $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" + OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" + OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" + OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" + OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" + OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" + OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" + OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" + OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" + OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" + OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" + OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" + OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" + OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" + OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" + OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" + OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" + OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" + OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" + OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" + OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" + OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" + OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" + OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" + OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" + OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" + OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" + OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" + OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" + OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" + OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" + OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" + OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" + OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; + + $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" + OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" + OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" + OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" + OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" + OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" + OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" + OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" + OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" + OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" + OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" + OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" + OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" + OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" + OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" + OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" + OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" + OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" + OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" + OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; + + | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | + union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", + event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Masquerading - Rename System Utilities + cis20: + - CIS 8 + confidence: 80 + context: + - source:endpoint + - stage: Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default + folder path in host $dest_device_id$ + mitre_attack_id: + - T1036 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - _time + - dest_user_id + - process_path + risk_score: 56 + risk_severity: low + security_domain: endpoint +type: Anomaly +version: 3 diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/unusually_long_command_line.yml new file mode 100644 index 0000000000..9338c1af46 --- /dev/null +++ b/dist/ssa/detections/unusually_long_command_line.yml @@ -0,0 +1,136 @@ +author: Ignacio Bermudez Corrales, Splunk +datamodel: [] +date: '2020-10-06' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: Command lines that are extremely long may be indicative of malicious + activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin + to help identify command lines with lengths that are unusual for a given user. This + detection is inspired on Unusually Long Command Line authored by Rico Valdez. +how_to_implement: You must be ingesting sysmon endpoint data that monitors command + lines. +id: 58f43aba-1775-445e-b19c-be2b87d83ae3 +known_false_positives: This detection may flag suspiciously long command lines when + there is not sufficient evidence (samples) for a given process that this detection + is tracking; or when there is high variability in the length of the command line + for the tracked process. Also, some legitimate applications may use long command + lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. + Attackers may use this technique to obfuscate their payloads. +mappings: + cis20: + - CIS 8 + kill_chain_phases: + - Actions on Objectives + nist: + - PR.PT + - DE.CM +name: Unusually Long Command Line +product: +- Splunk Behavioral Analytics +references: [] +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 12 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 12 +risk_message: A process $process_name$ with a long commandline $cmd_line$ executed + in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Unusual Processes + cis20: + - CIS 8 + confidence: 40 + context: + - source:endpoint + - stage: Defense Evasion + impact: 30 + kill_chain_phases: + - Actions on Objectives + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval + cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, + /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, + ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, + input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 + | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", + "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", + event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Unusual Processes + cis20: + - CIS 8 + confidence: 40 + context: + - source:endpoint + - stage: Defense Evasion + impact: 30 + kill_chain_phases: + - Actions on Objectives + message: A process $process_name$ with a long commandline $cmd_line$ executed in + host $dest_device_id$ + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 12 + risk_severity: medium + security_domain: endpoint +type: Anomaly +version: 1 diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml new file mode 100644 index 0000000000..df1f647b78 --- /dev/null +++ b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml @@ -0,0 +1,156 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-15' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: The wevtutil.exe application is the windows event log utility. This searches + for wevtutil.exe with parameters for clearing the application, security, setup, + powershell, sysmon, or system event logs. +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +id: 5438113c-cdd9-11eb-93b8-acde48001122 +known_false_positives: The wevtutil.exe application is a legitimate Windows event + log utility. Administrators may use it to manage Windows event logs. +mappings: + cis20: + - CIS 8 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP +name: WevtUtil Usage To Clear Logs +product: +- Splunk Behavioral Analytics +references: +- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 63 +risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear + event logs in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Windows Log Manipulation + - Ransomware + - Clop Ransomware + cis20: + - CIS 8 + - CIS 13 + confidence: 90 + context: + - source:endpoint + - stage: Defense Evasion + impact: 70 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, + /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, + /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, + /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + - Clop Ransomware + cis20: + - CIS 8 + - CIS 13 + confidence: 90 + context: + - source:endpoint + - stage: Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear + event logs in host $dest_device_id$ + mitre_attack_id: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 2 diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..bc72c7e903 --- /dev/null +++ b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,151 @@ +author: Teoderick Contreras, Splunk +datamodel: +- Endpoint +date: '2021-06-15' +deployment: + alert_action: + notable: + nes_fields: + - user + - dest + - src + rule_description: '%description%' + rule_title: '%name%' + author: Bhavin Patel + date: '2020-04-27' + description: This configuration file applies to all correlation searches that are + used for detection + id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 + name: Enterprise Security deployment configuration + scheduling: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto + tags: + analytic_story: all +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +known_false_positives: network operator may disable audit event logs for debugging + purposes. +mappings: + cis20: + - CIS 8 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP +name: Wevtutil Usage To Disable Logs +product: +- Splunk Behavioral Analytics +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +risk: +- risk_object_field: dest_device_id + risk_object_type: system + risk_score: 63 +- risk_object_field: dest_user_id + risk_object_type: user + risk_score: 63 +risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable + event logs in host $dest_device_id$ +savedsearch_annotations: + analytic_story: + - Windows Log Manipulation + - Ransomware + cis20: + - CIS 8 + - CIS 13 + confidence: 90 + context: + - source:endpoint + - stage: Defense Evasion + impact: 70 + kill_chain_phases: + - Exploitation + mitre_attack: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, + "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + cis20: + - CIS 8 + - CIS 13 + confidence: 90 + context: + - source:endpoint + - stage: Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable + event logs in host $dest_device_id$ + mitre_attack_id: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: user + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint +type: TTP +version: 2 From 69bcff647cddb1f7e5adbe0aa02feac13c362402 Mon Sep 17 00:00:00 2001 From: d1vious Date: Sat, 30 Oct 2021 23:27:09 -0400 Subject: [PATCH 2/7] cleaned up logic --- bin/generate.py | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index cb7f4b13f0..3d6d11d9ec 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -105,7 +105,7 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH): manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml' with open(manifest_file, 'w') as file: documents = yaml.dump(d, file, sort_keys=True) - + return OUTPUT_PATH + '/detections/' def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH): @@ -344,19 +344,10 @@ def add_annotations(detection): detection['tags']['risk_severity'] = 'medium' else: detection['tags']['risk_severity'] = 'low' - return detection def add_rba(detection): - # removed since this is causing a duplicate bug in ES 6.4+ - # if 'risk_object' in detection['tags']: - # detection['risk_object'] = detection['tags']['risk_object'] - # if 'risk_object_type' in detection['tags']: - # detection['risk_object_type'] = detection['tags']['risk_object_type'] - # if 'risk_score' in detection['tags']: - # detection['risk_score'] = detection['tags']['risk_score'] - # grab risk message if 'message' in detection['tags']: detection['risk_message'] = detection['tags']['message'] @@ -676,27 +667,32 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): if 'deprecated' in d: deprecated.append(d) + detection_path = '' + lookups_path = '' + lookups_files= '' + use_case_lib_path = '' + macros_path = '' + workbench_panels_objects = '' + if global_product == 'SSA': detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) - if VERBOSE: - print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) - print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) - + objects["macros"] = [] else: + detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH) - detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH) - if VERBOSE: - print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path)) - print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) - print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) - print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path)) - print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*")) - print("security content generation completed..") + + if VERBOSE: + print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path)) + print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) + print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) + print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path)) + print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*")) + print("security content generation completed..") if __name__ == "__main__": From bc3209042ba4ea2fc6fc1fbc1b106ab2b19bf16d Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 1 Nov 2021 18:55:23 -0400 Subject: [PATCH 3/7] pretty print search yaml, update ci --- .github/workflows/build-and-validate.yml | 185 +++---- bin/generate.py | 9 + ...tolen_credentials_via_mimikatz_modules.yml | 69 +-- ...en_credentials_via_powersploit_modules.yml | 73 +-- ...ntial_strength_via_dsinternals_modules.yml | 62 +-- .../detections/attempt_to_delete_services.yml | 58 +- .../attempt_to_disable_services.yml | 61 +-- ...dential_dump_from_registry_via_reg_exe.yml | 67 +-- ..._of_fgdump_and_cachedump_with_s_option.yml | 68 +-- ..._of_fgdump_and_cachedump_with_v_option.yml | 63 +-- ...cative_of_lazagne_command_line_options.yml | 57 +- ...nternals_credential_conversion_modules.yml | 73 +-- ...dicative_of_use_of_dsinternals_modules.yml | 77 +-- ..._indicative_of_use_of_mimikatz_modules.yml | 66 +-- ...dicative_of_use_of_powersploit_modules.yml | 68 +-- ...crosoft_debuggers_peek_into_the_kernel.yml | 66 +-- ...ft_debuggers_via_z_command_line_option.yml | 61 +-- ...present_in_powersploit_and_dsinternals.yml | 57 +- dist/ssa/detections/delete_a_net_user.yml | 59 +-- .../deny_permission_using_cacls_utility.yml | 65 +-- ...detect_dump_lsass_memory_using_comsvcs.yml | 57 +- dist/ssa/detections/detect_kerberoasting.yml | 68 +-- dist/ssa/detections/detect_pass_the_hash.yml | 70 +-- ...ohibited_applications_spawning_cmd_exe.yml | 71 +-- .../detections/disable_net_user_account.yml | 59 +-- .../first_time_seen_command_line_argument.yml | 81 +-- .../grant_permission_using_cacls_utility.yml | 65 +-- ...o_user_content_via_powersploit_modules.yml | 67 +-- ...count_creation_via_powersploit_modules.yml | 58 +- ..._deletion_of_logs_via_mimikatz_modules.yml | 59 +-- ...ng_of_accounts_via_dsinternals_modules.yml | 61 +-- ...s_and_policies_via_dsinternals_modules.yml | 64 +-- ...ctory_elements_via_powersploit_modules.yml | 65 +-- ...nd_persistence_via_powersploit_modules.yml | 65 +-- ...ivilege_elevation_via_mimikatz_modules.yml | 61 +-- ...d_process_control_via_mimikatz_modules.yml | 67 +-- ...rocess_control_via_powersploit_modules.yml | 79 +-- ...fy_acls_permission_of_files_or_folders.yml | 61 +-- ...lbas_applications_in_short_time_period.yml | 112 ++-- ...ction_by_machine_learning_method_-_ssa.yml | 78 +-- ...ash_observed_at_the_destination_device.yml | 86 +-- ...observed_by_an_event_collecting_device.yml | 86 +-- ...en_credentials_via_powersploit_modules.yml | 62 +-- ...rare_parent-child_process_relationship.yml | 123 ++--- ...counts_and_groups_via_mimikatz_modules.yml | 61 +-- ...s_and_policies_via_powersploit_modules.yml | 104 ++-- ...infrastructure_via_powersploit_modules.yml | 81 +-- ...rs_and_domains_via_powersploit_modules.yml | 70 +-- ...cess_to_computers_via_mimikatz_modules.yml | 58 +- ...ystem_elements_via_powersploit_modules.yml | 79 +-- ...sses_and_services_via_mimikatz_modules.yml | 61 +-- ..._shared_resources_via_mimikatz_modules.yml | 61 +-- ...ared_resources_via_powersploit_modules.yml | 70 +-- ..._opportunities_via_powersploit_modules.yml | 83 +-- ...f_connectivity_via_powersploit_modules.yml | 72 +-- ...ores_and_services_via_mimikatz_modules.yml | 69 +-- ...efensive_tools_via_powersploit_modules.yml | 61 +-- ..._opportunities_via_powersploit_modules.yml | 60 +-- ...ing_opportunities_via_mimikatz_modules.yml | 60 +-- .../resize_shadowstorage_volume.yml | 60 +-- ...ng_credentials_via_dsinternals_modules.yml | 73 +-- ...tting_credentials_via_mimikatz_modules.yml | 61 +-- ...ng_credentials_via_powersploit_modules.yml | 60 +-- ...ocess_running_from_unexpected_location.yml | 499 +++++++++--------- .../unusually_long_command_line.yml | 68 +-- .../wevtutil_usage_to_clear_logs.yml | 70 +-- .../wevtutil_usage_to_disable_logs.yml | 65 +-- 67 files changed, 1233 insertions(+), 3862 deletions(-) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index 8bde3c2b45..9062ef3a8c 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -23,7 +23,7 @@ jobs: steps: - name: TAGGED, Validate that the tag is in the correct format - + run: | echo "The GITHUB_REF: $GITHUB_REF" #First check to see if the release is a tag @@ -32,7 +32,7 @@ jobs: #is in the correct format (like v1.10.20) if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then echo "PASS: Tagged release with good format" - exit 0 + exit 0 else echo "FAIL: Tagged release with bad format" exit 1 @@ -49,14 +49,14 @@ jobs: runs-on: ubuntu-latest needs: [validate-tag-if-present] steps: - #Previous config chose which branch/tag to operate on. + #Previous config chose which branch/tag to operate on. #I think Github is smart enough to choose based on whether it's a pull request or push + other info? - - name: Check out the repository code + - name: Check out the repository code uses: actions/checkout@v2 #with: # repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD # path: "security-content" - + - uses: actions/setup-python@v2 with: @@ -66,14 +66,14 @@ jobs: #TODO: CircleCI restore_cache equivalent - #don't need to install python3 or python3-dev since it was handled by the action above? + #don't need to install python3 or python3-dev since it was handled by the action above? #Also, no support for YAML anchors/aliases in Github Actions... - name: Install System Packages - run: | + run: | sudo apt update -qq - sudo apt install jq -qq - #TODO: CircleCI save_cache equivalent - + sudo apt install jq -qq + #TODO: CircleCI save_cache equivalent + - name: Install Python Dependencies run: | #Get the virtualenv set up @@ -83,19 +83,19 @@ jobs: python3 -m pip install --upgrade pip python3 -m pip install wheel python3 -m pip install -q -r requirements.txt - - - name: run validate - run: | + + - name: run validate + run: | source venv/bin/activate python3 contentctl.py --path . --verbose validate - - name: Get CTI Repo for Mitre context - uses: actions/checkout@v2 + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 with: repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD path: "cti/" - + #Now generate the documentation (uses Node) - uses: actions/setup-node@v2 @@ -108,18 +108,18 @@ jobs: #Enter the virtualenv and run the docgen source venv/bin/activate python3 bin/doc_gen.py --path . --output docs -v - + #Now generate the spec docs npm install -g @adobe/jsonschema2md jsonschema2md -d spec -o docs/spec -f yaml -e spec.json -x - #Clean up extra properties on docs rm -rf docs/spec/*-*.md - + echo "****** BRANCH INFORMATION ******" git branch git branch --show-current - + build-sources: runs-on: ubuntu-latest needs: validate-content @@ -128,10 +128,10 @@ jobs: uses: actions/checkout@v2 - name: Install System Packages - run: | + run: | sudo apt update -qq - sudo apt install jq -qq - + sudo apt install jq -qq + - name: Install Python Dependencies run: | #Get the virtualenv set up @@ -143,18 +143,15 @@ jobs: python3 -m pip install -q -r requirements.txt - name: Run Generate - run: | + run: | source venv/bin/activate python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops - # make a copy of use_case_lib in order to have ES work :-( - # cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf - # cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf - # cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf + python3 contentctl.py --path . --verbose generate --product SSA --output dist/ssa - name: Copy lookups .csv files - run: | + run: | # clean up current lookups rm -rf dist/escu/lookups rm -rf dist/saaws/lookups @@ -167,7 +164,7 @@ jobs: cp -rv *.csv ../dist/escu/lookups cp -rv *.csv ../dist/saaws/lookups cp -rv *.csv ../dist/devsecops/lookups - + #Tag is '' for non-tagged push and the tag name for a tagged release - name: Set tag id: vars @@ -198,7 +195,7 @@ jobs: sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf tar -czf content-pack-build-escu.tar.gz dist/escu/* - + # update build number and version for saaws sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf @@ -209,6 +206,9 @@ jobs: # update build number and version for devsecops tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/* + # update build number and version for ssa + tar -czf content-pack-build-ssa.tar.gz dist/ssa/* + - name: Persist to Workspace uses: actions/upload-artifact@v2 with: @@ -217,12 +217,13 @@ jobs: content-pack-build-escu.tar.gz content-pack-build-saaws.tar.gz content-pack-build-devsecops.tar.gz - + content-pack-build-ssa.tar.gz + build-package: runs-on: ubuntu-latest needs: [validate-content, build-sources] - + steps: - uses: actions/download-artifact@v2 with: @@ -234,12 +235,12 @@ jobs: with: python-version: '2.7' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - + - name: Get virtualenv for Python 2.7 run: | - sudo apt install virtualenv + sudo apt install virtualenv - - name: Grab Splunk Packaging Toolkit + - name: Grab Splunk Packaging Toolkit run : | curl -Ls https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz -o splunk-packaging-toolkit-latest.tar.gz mkdir slim-latest @@ -264,6 +265,7 @@ jobs: mv dist/escu DA-ESS-ContentUpdate mv dist/saaws DA-ESS_AmazonWebServices_Content mv dist/devsecops dev_sec_ops_analytics + slim package -o upload DA-ESS-ContentUpdate slim package -o upload DA-ESS_AmazonWebServices_Content slim package -o upload dev_sec_ops_analytics @@ -276,6 +278,9 @@ jobs: cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz + cp content-pack-build-ssa.tar.gz upload/SSA_Content-latest.tar.gz + sha256sum upload/SSA_Content-latest.tar.gz >> checksum.txt + touch tag-canary.txt - name: store_artifacts @@ -292,8 +297,9 @@ jobs: build/DA-ESS-ContentUpdate-latest.tar.gz build/DA-ESS_AmazonWebServices_Content-latest.tar.gz build/dev_sec_ops_analytics-latest.tar.gz + build/SSA_Content-latest.tar.gz build/checksum.txt - + #Everything below this line should ONLY run on a tag and nothing else #We still want all of the above checks to run and pass before running these @@ -301,7 +307,7 @@ jobs: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package] #Only run when tagged - if: startsWith(github.ref, 'refs/tags/') + if: startsWith(github.ref, 'refs/tags/') steps: - name: Checkout Repo @@ -319,10 +325,10 @@ jobs: - name: Install System Packages - run: | + run: | sudo apt update -qq sudo apt install jq -qq - + - name: Submit ESCU Package to AppInspect API @@ -333,8 +339,8 @@ jobs: cd bin #Enclose in quotes in case there are any special characters in the username/password #Better not to pass these arguments on the command line, if possible - ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" - + ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" + - name: Submit SAAWS Package to AppInspect API env: APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }} @@ -342,20 +348,20 @@ jobs: run: | cd bin ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" - + - name: Create report artifact if: always() run: | #Always create this, regardless of whether success or failure above tar -cvzf report.tar.gz report/ - - name: store_artifacts + - name: store_artifacts uses: actions/upload-artifact@v2 with: name: appinspect_reports path: | report.tar.gz - + #Still store the report, even if we have failed (otherwise we don't know why/how we failed) - name: store_artifacts_on_failure uses: actions/upload-artifact@v2 @@ -364,7 +370,7 @@ jobs: name: appinspect_reports_failure path: | report.tar.gz - + create-report: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect] @@ -375,13 +381,13 @@ jobs: uses: actions/checkout@v2 with: ref: 'develop' - - + + - name: Install System Packages - run: | + run: | sudo apt update -qq sudo apt install jq -qq - + - uses: actions/setup-python@v2 with: python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy @@ -396,12 +402,12 @@ jobs: python3 -m pip install --upgrade pip python3 -m pip install wheel python3 -m pip install -q -r requirements.txt - + - name: run reporting - run: | + run: | source venv/bin/activate python3 bin/reporting.py - + #Official, Verified Amazon-AWS Github Account Provided Action - uses: aws-actions/configure-aws-credentials@v1 with: @@ -410,23 +416,23 @@ jobs: # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - - name: Upload Reporting + - name: Upload Reporting run: | aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg" - + update-sources-github: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect, create-report] #Only run when tagged if: startsWith(github.ref, 'refs/tags/') - steps: + steps: - name: Checkout Repo uses: actions/checkout@v2 with: token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }} ref: 'develop' - + - uses: actions/setup-python@v2 with: python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy @@ -443,6 +449,8 @@ jobs: tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1 mkdir latest-saaws tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1 + mkdir latest-ssa + tar -zxf SSA_Content-latest.tar.gz -C latest-saaws --strip-components=1 - name: Install Python Dependencies run: | #Get the virtualenv set up @@ -452,9 +460,9 @@ jobs: python3 -m pip install --upgrade pip python3 -m pip install wheel python3 -m pip install -q -r requirements.txt - - - name: Get CTI Repo for Mitre context - uses: actions/checkout@v2 + + - name: Get CTI Repo for Mitre context + uses: actions/checkout@v2 with: repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD path: "cti/" @@ -463,33 +471,30 @@ jobs: id: vars run: | echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Run doc-gen - run: | - source venv/bin/activate - python3 bin/doc_gen.py --path . --output docs -v - - - name: Make YAMLs Pretty + + - name: Run doc-gen run: | source venv/bin/activate - python3 bin/pretty_yaml.py --path . -v + python3 bin/doc_gen.py --path . --output docs -v + + - name: Make YAMLs Pretty + run: | + source venv/bin/activate + python3 bin/pretty_yaml.py --path . -v - name: Run generate-coverage-map run: | source venv/bin/activate python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map - + - name: Update github with new docs and package bits run: | rm -rf dist mkdir dist - echo "Directory layout 3" - pwd - ls -lah mv latest-escu dist/escu mv latest-saaws dist/saaws + mv latest-ssa dist/ssa # configure git to prep for commit - #git config credential.helper 'cache --timeout=120' git config user.email "research@splunk.com" git config user.name "research bot" git config --global push.default simple @@ -500,7 +505,7 @@ jobs: # Push quietly to prevent showing the token in log #No need to provide any credentials git push - + publish-github-release: #Github-maintained release action is in archived state: https://github.com/actions/create-release @@ -510,7 +515,7 @@ jobs: #Only run when tagged if: startsWith(github.ref, 'refs/tags/') steps: - + #Get the artifacts that we need - uses: actions/download-artifact@v2 with: @@ -520,23 +525,24 @@ jobs: with: name: appinspect_reports - - + + #Rename those artifacts appropriately - name: Set tag id: vars run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}" - - name: Rename the content-update appropriately + - name: Rename the content-update appropriately run: | cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz - + cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz + #No checksum on the reports cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz - + cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt - + #Upload all of the artifacts that we have created using the third party #action recommended bu Github - name: Upload Release Artifacts @@ -545,18 +551,19 @@ jobs: files: | DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz + SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz checksum-${{ steps.vars.outputs.tag }}.txt - + attack-range-update: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release] #Only run when tagged if: startsWith(github.ref, 'refs/tags/') - steps: - + steps: + #Get the artifacts that we need - uses: actions/download-artifact@v2 with: @@ -569,20 +576,20 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - name: Sync latest ESCU to the Attack Range S3 bucket for apps run: | aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/ # make the file public since it is not by default aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read - + master-api-update: runs-on: ubuntu-latest needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update] #Only run when tagged if: startsWith(github.ref, 'refs/tags/') - steps: + steps: - name: Checkout Repo uses: actions/checkout@v2 with: @@ -607,7 +614,7 @@ jobs: - name: Create Baseline Folder run: | source venv/bin/activate - python3 bin/create_baseline_folder.py + python3 bin/create_baseline_folder.py #Official, Verified Amazon-AWS Github Account Provided Action - uses: aws-actions/configure-aws-credentials@v1 @@ -615,7 +622,7 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + aws-region: us-west-1 #assume we will always use this, could make this an environment variable... - name: Update API sources run: | @@ -637,5 +644,3 @@ jobs: echo "Error [Security Content API status: $API_STATUS]" exit 1 fi - - diff --git a/bin/generate.py b/bin/generate.py index 3d6d11d9ec..f9f3b2b394 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -103,6 +103,15 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH): for d in detections: manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml' + + # remove unused fields + del d['risk'] + del d['deployment'] + del d['mappings'] + + # pretty search + d['search'] = d['search'].replace("|", "\n|") + with open(manifest_file, 'w') as file: documents = yaml.dump(d, file, sort_keys=True) diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml index cc45d35518..87488976d4 100644 --- a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml +++ b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml @@ -1,66 +1,18 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 759a653f-cb92-40f9-94c9-ec4e47b0f709 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1068 - - T1078 - - T1098 - - T1134 - - T1543 - - T1547 - - T1548 - - T1554 - - T1556 - - T1558 - nist: - - PR.AC - - PR.IP name: Applying Stolen Credentials via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz - https://adsecurity.org/?p=1275 -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is violating authentication processes by injecting golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command @@ -107,17 +59,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, - /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true - OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true\ + \ OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line,\ + \ /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml index 64b347ee77..413b8ec165 100644 --- a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical accounts. This detection indicates such activities carried out by PowerSploit exploit @@ -30,38 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 270b482d-2af2-448f-9923-9cf005f61be4 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1068 - - T1078 - - T1098 - - T1134 - - T1543 - - T1547 - - T1548 - - T1554 - - T1555 - - T1558 - nist: - - PR.AC - - PR.IP name: Applying Stolen Credentials via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is violating authentication by injecting stolen credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account @@ -108,20 +60,17 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true - OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, - /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true )\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml index c419b6a6ce..c01d8defe4 100644 --- a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml +++ b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml @@ -1,60 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This detection identifies use of DSInternals modules that verify password strength, i.e., identify week accounts that would be easily compromised. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - - T1087 - - T1201 - - T1552 - - T1555 - nist: - - PR.AC - - PR.IP name: Assessment of Credential Strength via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 25 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$ savedsearch_annotations: @@ -95,17 +52,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Test-PasswordQuality/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/attempt_to_delete_services.yml index 8cb68ebd61..54233c7680 100644 --- a/dist/ssa/detections/attempt_to_delete_services.yml +++ b/dist/ssa/detections/attempt_to_delete_services.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, splunk datamodel: - Endpoint date: '2021-06-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue @@ -34,23 +12,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. id: a0c8c292-d01a-11eb-aa18-acde48001122 known_false_positives: unknown -mappings: - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP name: Attempt To delete Services product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -65,18 +31,18 @@ savedsearch_annotations: nist: - PR.DS - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%delete%\") AND process_name\ + \ = \"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/attempt_to_disable_services.yml index 7c2bd3edc6..f66428dfeb 100644 --- a/dist/ssa/detections/attempt_to_disable_services.yml +++ b/dist/ssa/detections/attempt_to_disable_services.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the @@ -34,24 +12,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. id: afb31de4-d023-11eb-98d5-acde48001122 known_false_positives: unknown -mappings: - cis20: - - CIS 9 - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP name: Attempt To Disable Services product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -66,19 +32,20 @@ savedsearch_annotations: nist: - PR.DS - PR.IP -search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, - "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") - AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval _datamodels=ucast(map_get(input_event,\ + \ \"_datamodels\"), \"collection\", []), body={} \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%disabled%\") AND like(cmd_line,\ + \ \"%config%\") AND process_name=\"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp,\ + \ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ + \ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\ + parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 8fc72d65c7..5eff79d0aa 100644 --- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,55 +1,17 @@ author: Jose Hernandez, Splunk datamodel: [] date: 2020-6-04 -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. how_to_implement: You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints. id: 14038953-e5f2-4daf-acff-5452062baf03 known_false_positives: None identified. -mappings: - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - DE.CM name: Attempted Credential Dump From Registry via Reg exe product: - Splunk Behavioral Analytics references: - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -85,20 +47,21 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, - "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" - OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true - AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, - /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time - = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) - | into write_ssa_detected_events(); ' +search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval process_name=lower(ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"\ + process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where process_name=\"cmd.exe\" OR process_name=\"reg.exe\" \n| where\ + \ cmd_line != null AND match_regex(cmd_line, /(?i)save\\s+/)=true AND ( match_regex(cmd_line,\ + \ /(?i)HKLM\\\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true\ + \ OR match_regex(cmd_line, /(?i)HKLM\\\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\ + \\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true\ + \ OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\System/)=true ) \n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),\ + \ body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name]) \n| into write_ssa_detected_events(); " tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml index 20eee0916c..eb5b8fc535 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is @@ -32,26 +11,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 312582f2-5e91-42c1-a275-cd67f31373c8 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of FGDump and CacheDump with s option product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,22 +50,21 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND process_name != null AND parent_process_name != null - AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, - /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true - AND match_regex(cmd_line, /(?i)\-s/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND process_name != null AND parent_process_name\ + \ != null AND match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true\ + \ AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\ + \ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-s/)=true\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml index b44bd8d721..3b8c7ac1c0 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is @@ -32,26 +11,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of FGDump and CacheDump with v option product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,20 +50,18 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, - /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true - AND match_regex(cmd_line, /(?i)\-v/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND process_name != null AND process_path !=\ + \ null AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\ + \ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-v/)=true\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml index 5e6d61ccf0..b885fd281a 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. LaZagne is @@ -31,27 +10,10 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 341975fa-4ad0-4f01-9acc-df4f69742db7 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - - T1555 - nist: - - PR.IP - - PR.AC name: Credential Extraction indicative of Lazagne command line options product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +49,14 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, - /(?i)all\s+\-oA\s+\-output/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)all\\s+\\-oA\\\ + s+\\-output/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\ + \ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml index 0f1da47b83..1389bb382b 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals @@ -30,28 +9,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of DSInternals credential conversion modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,25 +50,23 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, - "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true - OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, - /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true - OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, - /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true - OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, - /(?i)ConvertTo-UnicodePassword/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true\ + \ OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,\ + \ /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true\ + \ OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,\ + \ /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true\ + \ OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,\ + \ /(?i)ConvertTo-UnicodePassword/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml index 5df5b95af6..639980240f 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals @@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals tool kit is accessing sensitive credential material such as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ @@ -87,27 +50,25 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, - "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true - OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, - /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true - OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, - /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true - OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true - OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true - OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, - /(?i)Get-SamPasswordPolicy/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line, \"process_name\", process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml index 9886257714..a8a9c5bb55 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Mimikatz @@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 66 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,22 +49,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true - OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true - OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true - OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true - OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true\ + \ OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true\ + \ OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true\ + \ OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line,\ + \ /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\ + \ match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml index ee6f7d13a5..18b90a5d75 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit @@ -30,27 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 5f1186a4-e681-446e-851c-dc9574ad28eb known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction indicative of use of PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,23 +49,20 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true - OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true - OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, - /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true - OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, - /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true\ + \ OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml index a93b2f8aef..82a0286bde 100644 --- a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft @@ -34,27 +13,11 @@ known_false_positives: Although unlikely, using debuggers this way may be indica of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.IP - - PR.AC name: Credential Extraction native Microsoft debuggers peek into the kernel product: - Splunk Behavioral Analytics references: - https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29 -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -90,21 +53,20 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line != null AND parent_process_name != null AND process_name - != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, - /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true - AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND parent_process_name != null AND process_name\ + \ != null AND ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR match_regex(parent_process_name,\ + \ /(?i)livekd\\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\\.exe/)=true\ + \ AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\\\ + -ForceV1/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\ + \ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line, \"process_name\", process_name, \"parent_process_name\"\ + , parent_process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml index 350a3310d2..bc0f5ddf5d 100644 --- a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft @@ -34,26 +13,10 @@ known_false_positives: Although unlikely, using debuggers this way may be indica of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP name: Credential Extraction native Microsoft debuggers via z command line option product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -89,19 +52,17 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name, - /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, - /(?i)\-z\s+/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND process_name != null AND ( match_regex(process_name,\ + \ /^(?i)ntkd\\.exe/)=true OR match_regex(process_name, /^(?i)kd\\.exe/)=true ) AND\ + \ match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml index 20e91c8368..c357c97f08 100644 --- a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml +++ b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml @@ -1,27 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-10-18' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit @@ -31,27 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.IP - - PR.AC name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +50,15 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, - /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true\ + \ AND match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\\n|]+/)=true\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/delete_a_net_user.yml index bf0da7f982..d0e32cc584 100644 --- a/dist/ssa/detections/delete_a_net_user.yml +++ b/dist/ssa/detections/delete_a_net_user.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some @@ -37,23 +15,11 @@ how_to_implement: o successfully implement this search, you need to be ingesting id: 8776d79c-d26e-11eb-9a56-acde48001122 known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. -mappings: - cis20: - - CIS 4 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.AC - - PR.IP name: Delete A Net User product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -68,18 +34,19 @@ savedsearch_annotations: nist: - PR.AC - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" - OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/delete%\") AND (process_name=\"\ + net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp, end_time=timestamp,\ + \ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ + \ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\ + parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/deny_permission_using_cacls_utility.yml index b1d897652a..e4f680dc49 100644 --- a/dist/ssa/detections/deny_permission_using_cacls_utility.yml +++ b/dist/ssa/detections/deny_permission_using_cacls_utility.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-14' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection @@ -35,29 +13,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: b76eae28-cd25-11eb-9c92-acde48001122 known_false_positives: network administrator may use this windows utility but this is not a common practice. -mappings: - cis20: - - CIS 14 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - nist: - - PR.AC - - PR.IP name: Deny Permission using Cacls Utility product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 35 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 35 risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ savedsearch_annotations: @@ -87,18 +47,19 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true\ + \ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\ + icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml index 707f596534..e7291f5901 100644 --- a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml +++ b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml @@ -1,27 +1,6 @@ author: Jose Hernandez, Splunk datamodel: [] date: '2020-09-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This search detects the memory of lsass.exe being dumped for offline credential theft attack. how_to_implement: You must be ingesting endpoint data that tracks process activity, @@ -30,28 +9,11 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e known_false_positives: None identified. -mappings: - cis20: - - CIS 8 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003.003 - - T1003 - nist: - - DE.CM name: Detect Dump LSASS Memory using comsvcs product: - Splunk Behavioral Analytics references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,15 +49,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, - "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), - "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, - /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = - timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, - "process_name", process_name, "process", process]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval tenant=ucast(map_get(input_event,\ + \ \"_tenant\"), \"string\", null), machine=ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\ + ), \"string\", null)), process=lower(ucast(map_get(input_event, \"process\"), \"\ + string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where process_name LIKE \"%rundll32.exe%\" AND match_regex(process,\ + \ /(?i)comsvcs.dll[,\\s]+MiniDump/)=true \n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend(machine), body=create_map([\"event_id\", event_id,\ + \ \"process_name\", process_name, \"process\", process]) \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/detect_kerberoasting.yml index ef38ab913b..1db7da3626 100644 --- a/dist/ssa/detections/detect_kerberoasting.yml +++ b/dist/ssa/detections/detect_kerberoasting.yml @@ -1,27 +1,6 @@ author: Xiao Lin, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Patrick Bareiss - date: '2021-01-13' - description: Example for a deployment for a specific Analytics Story - id: 52f52a7c-078f-4413-84da-388b61ccac26 - name: Credential Dumping Story - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: Credential Dumping description: This search detects a potential kerberoasting attack via service principal name requests how_to_implement: The test data is converted from Windows Security Event logs generated @@ -29,28 +8,11 @@ how_to_implement: The test data is converted from Windows Security Event logs ge id: dabdd6d7-3e10-42be-8711-4e124f7a3850 known_false_positives: Older systems that support kerberos RC4 by default NetApp may generate false positives -mappings: - cis20: - - CIS 8 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1558.003 - - T1558 - nist: - - DE.CM name: Detect Kerberoasting product: - Splunk Behavioral Analytics references: - Initial ESCU implementation by Jose Hernandez and Patrick Bareiss -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 14 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,21 +48,21 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), - EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, - "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), - ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, - "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" - AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event - input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] - | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, - "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, - "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events() \n| eval _time=map_get(input_event,\ + \ \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event,\ + \ \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"\ + ), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event,\ + \ \"service_id\"), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"\ + string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"\ + 0x17\" \n| first_time_event input_columns=[\"EventCode\",\"TicketOptions\",\"TicketEncryptionType\"\ + ,\"ServiceName\",\"ServiceID\"] \n| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\ + \ \n| eval start_time=_time, end_time=_time, body=create_map([\"event_id\", event_id,\ + \ \"EventCode\", EventCode, \"ServiceName\", ServiceName, \"TicketOptions\", TicketOptions,\ + \ \"TicketEncryptionType\", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null))\n| select start_time, end_time, entities, body \n| into write_ssa_detected_events();" tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/detect_pass_the_hash.yml index 197806c9e7..ab5fdfc434 100644 --- a/dist/ssa/detections/detect_pass_the_hash.yml +++ b/dist/ssa/detections/detect_pass_the_hash.yml @@ -1,28 +1,6 @@ author: Xiao Lin, Splunk datamodel: [] date: '2020-10-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique. how_to_implement: The test data is converted from Windows Security Event logs generated @@ -30,32 +8,11 @@ how_to_implement: The test data is converted from Windows Security Event logs ge id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f known_false_positives: Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. -mappings: - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP name: Detect Pass the Hash product: - Splunk Behavioral Analytics references: - Initial ESCU implementation by Bhavin Patel and Patrick Bareiss -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 16 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Potential use of the pass the hash/token attacks that spoof authentication. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -95,21 +52,18 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) - | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event, - "authentication_type"), authentication_method=map_get(input_event, "authentication_method"), - origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event, - "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - - | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9" - AND authentication_method="seclogo") - - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, - "authentication_method", authentication_method]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval signature_id=map_get(input_event, \"signature_id\"\ + ), authentication_type=map_get(input_event, \"authentication_type\"), authentication_method=map_get(input_event,\ + \ \"authentication_method\"), origin_device_domain=map_get(input_event, \"origin_device_domain\"\ + ), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ + \ dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\ + \ event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null)\n\n| where\ + \ (authentication_type=\"3\" AND authentication_method=\"NtLmSsp\") OR (authentication_type=\"\ + 9\" AND authentication_method=\"seclogo\")\n\n| eval start_time=timestamp, end_time=timestamp,\ + \ entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"event_id\"\ + , event_id, \"authentication_type\", authentication_type, \"authentication_method\"\ + , authentication_method]) \n| into write_ssa_detected_events();" tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml index 426de847da..d83661a6e9 100644 --- a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: 2020-7-13 -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` @@ -33,26 +11,10 @@ id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 known_false_positives: There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1059 - nist: - - PR.PT - - DE.CM name: Detect Prohibited Applications Spawning cmd exe product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 56 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Potential malicious landing to the console via unexpected programs that called cmd.exe. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. @@ -91,24 +53,21 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) - | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), - parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", - null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) - - | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" - | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" - OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" - OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" - OR field0="java.exe" OR field0="powershell.exe" - - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, - "parent_process_name", parent_process]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval process_name=ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null), parent_process=lower(ucast(map_get(input_event,\ + \ \"parent_process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), event_id=ucast(map_get(input_event, \"\ + event_id\"), \"string\", null)\n\n| where process_name=\"cmd.exe\" \n| rex field=parent_process\ + \ \"(?[^\\\\\\\\]+)$\" \n| where field0=\"winword.exe\" OR field0=\"excel.exe\"\ + \ OR field0=\"outlook.exe\" OR field0=\"powerpnt.exe\" OR field0=\"visio.exe\" OR\ + \ field0=\"mspub.exe\" OR field0=\"acrobat.exe\" OR field0=\"acrord32.exe\" OR field0=\"\ + chrome.exe\" OR field0=\"iexplore.exe\" OR field0=\"opera.exe\" OR field0=\"firefox.exe\"\ + \ OR field0=\"java.exe\" OR field0=\"powershell.exe\"\n\n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"\ + event_id\", event_id, \"process_name\", process_name, \"parent_process_name\",\ + \ parent_process]) \n| into write_ssa_detected_events();" tags: analytic_story: - Suspicious Command-Line Executions diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/disable_net_user_account.yml index 75d483d560..81aba69c14 100644 --- a/dist/ssa/detections/disable_net_user_account.yml +++ b/dist/ssa/detections/disable_net_user_account.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious @@ -36,23 +14,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: ba858b08-d26c-11eb-af9b-acde48001122 known_false_positives: network operator may use this approach to quickly disable an account but not a common practice. -mappings: - cis20: - - CIS 4 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.AC - - PR.IP name: Disable Net User Account product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: [] savedsearch_annotations: analytic_story: - XMRig @@ -67,18 +33,19 @@ savedsearch_annotations: nist: - PR.AC - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" - OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/active:no%\") AND\ + \ (process_name=\"net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name, \"parent_process_name\", parent_process_name, \"process_path\",\ + \ process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/first_time_seen_command_line_argument.yml index b667e6a13c..06db177fa6 100644 --- a/dist/ssa/detections/first_time_seen_command_line_argument.yml +++ b/dist/ssa/detections/first_time_seen_command_line_argument.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: 2021-2-1 -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel. @@ -33,32 +11,10 @@ known_false_positives: Legitimate programs can also use command-line arguments t execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name -mappings: - cis20: - - CIS 3 - - CIS 8 - kill_chain_phases: - - Command and Control - - Actions on Objectives - mitre_attack: - - T1059 - - T1117 - - T1202 - nist: - - PR.PT - - DE.CM - - PR.IP name: First time seen command line argument product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 30 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 30 risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ savedsearch_annotations: @@ -92,23 +48,26 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), - "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), - cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, - "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, - "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" - */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), - /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, - /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) | - where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* - \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, - dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm - | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval dest_user_id=ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), process_name=ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), cmd_line_norm=lower(cmd_line), cmd_line_norm=replace(cmd_line_norm,\ + \ /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, \"\ + GUID\"), cmd_line_norm=replace(cmd_line_norm, /(?<=\\s)+\\\\[^:]*(?=\\\\.*\\.\\\ + w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \" \\\\Something\\\\Something\\\\command.ext\"\ + \ => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm, /\\w:\\\\[^:]*(?=\\\ + \\.*\\.\\w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \"C:\\\\Something\\\\Something\\\ + \\command.ext\" => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm,\ + \ /\\d+/, \"N\"), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where process_name=\"cmd.exe\" AND match_regex(ucast(cmd_line, \"string\"\ + , \"\"), /.* \\/[cC] .*/)=true \n| select process_name, cmd_line, cmd_line_norm,\ + \ timestamp, dest_device_id, dest_user_id \n| first_time_event input_columns=[\"\ + cmd_line_norm\"] \n| where first_time_cmd_line_norm \n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/grant_permission_using_cacls_utility.yml index 79b30217aa..4aa278c41b 100644 --- a/dist/ssa/detections/grant_permission_using_cacls_utility.yml +++ b/dist/ssa/detections/grant_permission_using_cacls_utility.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-14' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware and coinminer scripts to evade detections and restrict access @@ -35,29 +13,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: c6da561a-cd29-11eb-ae65-acde48001122 known_false_positives: network administrator may use this windows utility but this is not a common practice. -mappings: - cis20: - - CIS 14 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - nist: - - PR.AC - - PR.IP name: Grant Permission Using Cacls Utility product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 35 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 35 risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ savedsearch_annotations: @@ -87,18 +47,19 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true - AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true\ + \ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\ + icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml index f710887623..1d178e6b0e 100644 --- a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping into http and RDP sessions, etc. @@ -30,31 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 01fc7d91-eb0c-478e-8633-e4fa4904463a known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1113 - - T1123 - - T1563 - nist: - - PR.AC - - PR.IP name: Illegal Access To User Content via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 85 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is tapping into user content - microphone, camera, ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -95,20 +53,17 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR - match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true - OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, - /(?i)Get-WebConfig/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Malicious PowerShell diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml index f0cba48987..07b31c86e2 100644 --- a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml @@ -1,56 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that create accounts illegaly. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 20fba62a-fa5b-46cc-b39f-473fa248fee2 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1585 - nist: - - PR.AC - - PR.IP name: Illegal Account Creation via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is creating illegal domain accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +48,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)New-DomainUser/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml index 0e0886d920..a9603449f8 100644 --- a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml @@ -1,56 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that delete event logs. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1070 - nist: - - PR.AC - - PR.IP name: Illegal Deletion of Logs via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 50 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -87,17 +48,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true\ + \ OR match_regex(cmd_line, /(?i)event::clear/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Windows Log Manipulation diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml index 951cb37e77..2efd3130f9 100644 --- a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml +++ b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml @@ -1,57 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of DSInternals modules that enable or disable accounts illegaly. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 3e0f9962-9989-445f-878c-939443326b63 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Illegal Enabling or Disabling of Accounts via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -89,18 +49,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true\ + \ OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true )\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml index 399bc29caa..37d5050d0d 100644 --- a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml +++ b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml @@ -1,59 +1,18 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: a587ca9f-c138-47b4-ba51-699f319b8cc5 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1207 - - T1484 - nist: - - PR.AC - - PR.IP name: Illegal Management of Active Directory Elements and Policies via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals malware is controlling infrastructure by modifying Active Directory elements, domain controllers, and policies. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,19 +51,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true - OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, - /(?i)Set-LsaPolicyInformation/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml index 949a8f9c79..ecba1f0562 100644 --- a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml @@ -1,59 +1,18 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 75760c11-7d48-4968-b828-013b299e8f6d known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1207 - - T1484 - nist: - - PR.AC - - PR.IP name: Illegal Management of Computers and Active Directory Elements via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is controlling infrastructure by modifying Active Directory elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,20 +51,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR - match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, - /(?i)Set-MasterBootRecord/)=true ) - - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )\n\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 96a76208ab..fd38b58f4c 100644 --- a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent WMI, access to OS objects under desired identities. @@ -30,30 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 88c10ee9-fe72-4bce-b343-5b129044b991 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1053 - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP name: Illegal Privilege Elevation and Persistence via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is planting attack persistence elements, altering privileges and access controls. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -95,19 +54,17 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true - OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true - OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true\ + \ OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true\ + \ OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,\ + \ /(?i)New-UserPersistenceOption/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Malicious PowerShell diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml index 04a239f103..1292ab88eb 100644 --- a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml @@ -1,57 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for illegal privilege elevation. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 2f873b1f-6352-4844-b7b9-b419f09a42c7 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP name: Illegal Privilege Elevation via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is setting highest privileges to malicious entities. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -90,18 +50,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true\ + \ OR match_regex(cmd_line, /(?i)token::elevate/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Windows Privilege Escalation diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml index 5e2fe5e498..77f4173183 100644 --- a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: aaf3adf1-73e1-4477-b4ee-3771898964f1 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1106 - - T1569 - nist: - - PR.AC - - PR.IP name: Illegal Service and Process Control via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -91,20 +50,18 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, - /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, - /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true - OR match_regex(cmd_line, /(?i)misc::memssp/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true\ + \ OR match_regex(cmd_line, /(?i)service::\\+/)=true OR match_regex(cmd_line, /(?i)service::\\\ + -/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,\ + \ /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true\ + \ OR match_regex(cmd_line, /(?i)misc::memssp/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ + \ into write_ssa_detected_events();" tags: analytic_story: - Windows Service Abuse diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml index 477c3ba9b4..a66a0928bb 100644 --- a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-09' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, @@ -31,30 +9,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 0e910e5b-309d-4bc3-8af2-0030c02aa353 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1106 - - T1569 - nist: - - PR.AC - - PR.IP name: Illegal Service and Process Control via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -94,27 +53,23 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true - OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, - /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true - OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, - /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true - OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, - /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true - OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, - /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true - ) - - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line,\ + \ /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true\ + \ OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true\ + \ OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true )\n\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Service Abuse diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml index 4ed844eb1a..611f9ca6af 100644 --- a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes @@ -37,23 +15,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin id: 9ae9a48a-cdbe-11eb-875a-acde48001122 known_false_positives: network administrator may use this windows utility. filter is needed. -mappings: - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 name: Modify ACLs Permission Of Files Or Folders product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 35 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 35 risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ savedsearch_annotations: @@ -77,19 +43,20 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, - /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" - OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), - "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, - "parent_process_name", parent_process_name, "process_path", process_path]) | into - write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/G%\") AND (match_regex(cmd_line,\ + \ /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name=\"\ + cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"icacls.exe\") \n| eval\ + \ start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml index 79e77dfec0..979043c45f 100644 --- a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml +++ b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2020-08-25' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine. @@ -33,28 +11,11 @@ known_false_positives: 'Some administrative tasks may involve multiple use of LO beginning when it hasn''t collected yet enough data to construct the baseline. ' -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1059 - - T1053 - nist: - - PR.PT - - DE.CM name: More than usual number of LOLBAS applications in short time period product: - Splunk Behavioral Analytics references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 25 -- threat_object_field: process_name - threat_object_type: processname risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ savedsearch_annotations: @@ -84,40 +45,45 @@ savedsearch_annotations: role: - Others type: processname -search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, - "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" - OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" - OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" - OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" - OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" - OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" - OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" - OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" - OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" - OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" - OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" - OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" - OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" - OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" - OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" - OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" - OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" - OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" - OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" - OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" - OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR - process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" - OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" - OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" - OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" - OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by - device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end - as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" - window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, - end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", - lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), process_name=lower(ucast(map_get(input_event,\ + \ \"process_name\"), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| where process_name==\"regsvcs.exe\" OR process_name==\"\ + ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"\ + schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\"\ + \ OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"\ + reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"\ + print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"\ + rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR\ + \ process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"\ + mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\"\ + \ OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"\ + microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"\ + makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\"\ + \ OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"\ + register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"\ + ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"\ + hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"\ + jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\"\ + \ OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"\ + diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\"\ + \ OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"\ + gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\"\ + \ OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"\ + gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"\ + regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"\ + syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"\ + psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\"\ + \ OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"\ + netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"\ + at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"\ + msconfig.exe\" \n| stats count(process_name) as lolbas_counter by device,span(timestamp,\ + \ 300s) \n| eval lolbas_counter=lolbas_counter*1.0 \n| rename window_end as timestamp\ + \ \n| adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"\ + device\" window=2419200000L \n| where label AND quantile>0.99 \n| eval start_time\ + \ = window_start, end_time = timestamp, entities = mvappend(device), body=create_map([\"\ + lolbas_counter\", lolbas_counter, \"quantile\", quantile, \"device\", device]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml index db7700693f..f39d42227a 100644 --- a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml +++ b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml @@ -1,28 +1,6 @@ author: Xiao Lin, Splunk datamodel: [] date: '2020-08-25' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: Malicious mails can conduct phishing that induces readers to open attachment, click links or trigger third party service. This detect uses Natural Language Processing (NLP) approach to analyze an email message's content (Sender, Subject and Body) @@ -42,21 +20,10 @@ id: 4b237388-dfa1-41a6-91d4-4de2d598376f known_false_positives: Because of imbalance of anomaly data in training, the model will less likely report false positive. Instead, the model is more prone to false negative. Current best recall score is ~85% -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1566 - nist: - - PR.PT - - DE.CM name: Phishing Email Detection by Machine Learning Method - SSA product: - Splunk Behavioral Analytics references: [] -risk: [] savedsearch_annotations: cis20: - CIS 8 @@ -67,26 +34,31 @@ savedsearch_annotations: nist: - PR.PT - DE.CM -search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event, - "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " - "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), - _time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={" - ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, - ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, - "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, - ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, - "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, - "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, - "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, - "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": - 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": - 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": - 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in - = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, - 1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8" - path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out, - 0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD", - body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval eventLine=concat(ucast(map_get(input_event,\ + \ \"From\"), \"string\", \" \"), \" \", ucast(map_get(input_event, \"Subject\"),\ + \ \"string\", \" \"), \" \", ucast(map_get(input_event, \"Content\"), \"string\"\ + , \" \"), \" \ + \ \"), _time=map_get(input_event,\ + \ \"_time\") \n| where eventLine IS NOT NULL \n| eval mapC={\" \": 32, \"!\": 33,\ + \ \"\\\"\": 34, \"#\": 35, \"$\": 36, \"%\": 37, \"&\": 38, \"`\": 39, \"(\": 40,\ + \ \")\": 41, \"*\": 42, \"+\": 43, \",\": 44, \"-\": 45, \".\": 46, \"/\": 47, \"\ + 0\": 48, \"1\": 49, \"2\": 50, \"3\": 51, \"4\": 52, \"5\": 53, \"6\": 54, \"7\"\ + : 55, \"8\": 56, \"9\": 57, \":\": 58, \";\": 59, \"<\": 60, \"=\": 61, \">\": 62,\ + \ \"?\": 63, \"@\": 64, \"A\": 65, \"B\": 66, \"C\": 67, \"D\": 68, \"E\": 69, \"\ + F\": 70, \"G\": 71, \"H\": 72, \"I\": 73, \"J\": 74, \"K\": 75, \"L\": 76, \"M\"\ + : 77, \"N\": 78, \"O\": 79, \"P\": 80, \"Q\": 81, \"R\": 82, \"S\": 83, \"T\": 84,\ + \ \"U\": 85, \"V\": 86, \"W\": 87, \"X\": 88, \"Y\": 89, \"Z\": 90, \"[\": 91, \"\ + \\\\\": 92, \"]\": 93, \"^\": 94, \"_\": 95, \"`\": 96, \"a\": 97, \"b\": 98, \"\ + c\": 99, \"d\": 100, \"e\": 101, \"f\": 102, \"g\": 103, \"h\": 104, \"i\": 105,\ + \ \"j\": 106, \"k\": 107, \"l\": 108, \"m\": 109, \"n\": 110, \"o\": 111, \"p\"\ + : 112, \"q\": 113, \"r\": 114, \"s\": 115, \"t\": 116, \"u\": 117, \"v\": 118, \"\ + w\": 119, \"x\": 120, \"y\": 121, \"z\": 122, \"{\": 123, \"\n|\": 124, \"}\": 125,\ + \ \"~\": 126}, ml_in = for_each(iterator(mvrange(1,129), \"i\"), cast(map_get(mapC,\ + \ substr(eventLine, i, 1)), \"float\") ) \n| apply_model connection_id=\"YOUR_S3_ONNX_CONNECTOR_ID\"\ + \ name=\"phishing_email_v8\" path=\"s3://smle-experiments/models/phishing_email\"\ + \ \n| eval probability = mvindex(ml_out, 0) \n| where probability > 0.5 \n| eval\ + \ start_time=_time, end_time=_time, entities=\"TBD\", body=\"TBD\" \n| select probability,\ + \ body, entities, start_time, end_time \n| into write_ssa_detected_events();" tags: cis20: - CIS 8 diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index 19defdc846..c5908a22a5 100644 --- a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2021-09-01' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported @@ -32,26 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi id: 82e76b80-5cdb-4899-9b43-85dbe777b36d known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Lateral Movement - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP name: Potential Pass the Token or Hash Observed at the Destination Device product: - Splunk Behavioral Analytics references: - https://attack.mitre.org/techniques/T1550/002/ -risk: [] risk_message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$ @@ -87,34 +50,27 @@ savedsearch_annotations: role: - Other type: Hostname -search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), - "string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), - "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), - "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), - "string", null)) - - | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") - AND dest_user_id != null AND dest_device_id != null - - | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method - == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) - - | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as - startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as - endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) - - | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND - (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) - - | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, - "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos", - totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", - endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime]) - - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\ + \ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null)), dest_device_id= lower(ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\ + \ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\ + \ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\ + \ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\ + \ AND dest_user_id != null AND dest_device_id != null\n\n| eval isKerberos=if(authentication_method\ + \ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\ + \ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\ + \ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\ + \ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\ + \ dest_user, dest_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\ + -\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\ + \ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\ + \ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=ucast(startNTLMTime,\ + \ \"long\", null), end_time=ucast(endNTLMTime, \"long\", null), entities=mvappend(dest_user_id,\ + \ dest_device_id), body=create_map([\"total_kerberos\", totalKerberos, \"total_ntlm\"\ + , totalNtlm, \"analysis_start_time\", startTime, \"analysis_end_time\", endTime,\ + \ \"pth_start_time\", startNTLMTime, \"pth_end_time\", endNTLMTime])\n\n| into write_ssa_detected_events();" tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index 366ec7fda1..2c2f92b9e0 100644 --- a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2021-09-01' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported @@ -34,26 +12,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Lateral Movement - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP name: Potential Pass the Token or Hash Observed by an Event Collecting Device product: - Splunk Behavioral Analytics references: - https://attack.mitre.org/techniques/T1550/002/ -risk: [] risk_message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ @@ -89,34 +52,27 @@ savedsearch_annotations: role: - Other type: Hostname -search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), - "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), - "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), - "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), - "string", null)) - - | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") - AND dest_user_id != null AND origin_device_id != null - - | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method - == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) - - | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as - startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as - endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) - - | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND - (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) - - | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, - origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm", - totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time", - startNTLMTime, "detection_end_time", endNTLMTime]) - - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\ + \ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null)), origin_device_id= lower(ucast(map_get(input_event,\ + \ \"origin_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\ + \ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\ + \ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\ + \ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\ + \ AND dest_user_id != null AND origin_device_id != null\n\n| eval isKerberos=if(authentication_method\ + \ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\ + \ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\ + \ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\ + \ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\ + \ dest_user, origin_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\ + -\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\ + \ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\ + \ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=startNTLMTime, end_time=endNTLMTime,\ + \ entities=mvappend(dest_user_id, origin_device_id), body=create_map([\"total_kerberos\"\ + , totalKerberos, \"total_ntlm\", totalNtlm, \"analysis_start_time\", startTime,\ + \ \"analysis_end_time\", endTime, \"detection_start_time\", startNTLMTime, \"detection_end_time\"\ + , endNTLMTime])\n\n| into write_ssa_detected_events();" tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml index 17c05fc1f4..83a838da56 100644 --- a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -1,57 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-04' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: d405af5d-99f1-45af-8dfb-b8f98b764247 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Probing Access with Stolen Credentials via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 60 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is probing access with stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -89,18 +49,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true - OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line,\ + \ /(?i)Test-ServiceDaclPermission/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Privilege Escalation diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/rare_parent-child_process_relationship.yml index c9abcfe4e0..4cc2eaa5e4 100644 --- a/dist/ssa/detections/rare_parent-child_process_relationship.yml +++ b/dist/ssa/detections/rare_parent-child_process_relationship.yml @@ -1,28 +1,6 @@ author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2021-05-20' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has @@ -34,24 +12,10 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to it hasn''t collected yet enough data to construct the baseline. ' -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1203 - - T1059 - - T1053 - - T1072 - nist: - - PR.PT - - DE.CM name: Rare Parent-Child Process Relationship product: - Splunk Behavioral Analytics references: [] -risk: [] savedsearch_annotations: analytic_story: - Unusual Processes @@ -67,47 +31,52 @@ savedsearch_annotations: nist: - PR.PT - DE.CM -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, - "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, - "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, - "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, - timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" - target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" - OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" - OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" - OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" - OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" - OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" - OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" - OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" - OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" - OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" - OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" - OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" - OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" - OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" - OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" - OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" - OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" - OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" - OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" - OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" - OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" - OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR - process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" - OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" - OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" - OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") - | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 - window=604800000L | where label AND input > mean | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = - create_map(["process_name", process_name, "parent_process_name", parent_process_name, - "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", - cmd_line]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval parent_process=lower(ucast(map_get(input_event,\ + \ \"parent_process_name\"), \"string\", null)), parent_process_name=mvindex(split(parent_process,\ + \ \"\\\\\"), -1), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\",\ + \ null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null) \n\ + | where parent_process_name!=null \n| select parent_process_name, process_name,\ + \ cmd_line, timestamp, dest_device_id, dest_user_id \n| conditional_anomaly conditional=\"\ + parent_process_name\" target=\"process_name\" \n| where (process_name=\"powershell.exe\"\ + \ OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"\ + dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR\ + \ process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"\ + esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"\ + csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"\ + pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"\ + wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR\ + \ process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"\ + bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR\ + \ process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR\ + \ process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"\ + forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\"\ + \ OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR\ + \ process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"\ + sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"\ + cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"\ + scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\"\ + \ OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"\ + extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\"\ + \ OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"\ + rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\"\ + \ OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR\ + \ process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"\ + wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\"\ + \ OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"\ + infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\"\ + \ OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"\ + wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"\ + pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\") \n\ + | eval input = (-1)*log(output) \n| adaptive_threshold algorithm=\"gaussian\" threshold=0.001\ + \ window=604800000L \n| where label AND input > mean \n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body\ + \ = create_map([\"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"input\", input, \"mean\", mean, \"variance\", variance, \"output\", output,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml index 2ff6c7f862..a0cd27b5dc 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is searching for and using specific accounts and groups. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,17 +51,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true\ + \ OR match_regex(cmd_line, /(?i)net::group/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml index 820d6be3cd..ee09af5fc7 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 63422f8e-766c-468f-8133-2ba6795e263b known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for and using specific accounts, groups and policies, such as the last logged on account, a local Net group, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command @@ -93,39 +52,36 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true - OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, - /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true - OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, - /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true - OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, - /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true - OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true - OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, - /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true - OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, - /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true - OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true - OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, - /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true - OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true - OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true - OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, - /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true - OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, - /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true - OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, - /(?i)Get-LastLoggedOn/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line,\ + \ /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR\ + \ match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,\ + \ /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-LastLoggedOn/)=true )\n\n| eval start_time = timestamp, end_time = timestamp,\ + \ entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\"\ + , null), ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml index b6f27005e6..fe51886cbe 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, AD sites and forests, and trust relations. @@ -30,33 +8,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: db08ac40-ee14-43e9-9a75-dddd059ef812 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1199 - - T1482 - - T1590 - - T1591 - - T1595 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is seaching for or accessing Active Directory objects such as domain sites, domain trusts, AD forests, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -98,26 +55,24 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR - match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true - OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true - OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, - /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true - OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true - OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true - OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, - /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true - OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml index 45ef344b62..e019910150 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592 - - T1590 - - T1087 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Computers and Domains via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is seaching for or accessing domain controllers, computers, file servers, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,22 +51,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR - match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true - OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true - OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, - /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml index 7c4ed009d8..2de8b461e3 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml @@ -1,56 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Computers via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 50 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is collecting information about computers. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -86,17 +47,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)net::ServerInfo/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml index 5126b89eb0..b6ecc600ca 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, security packages and files. @@ -30,36 +8,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1057 - - T1083 - - T1592.002 - - T1046 - - T1012 - - T1007 - - T1047 - - T1592 - - T1518 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Operating System Elements via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for and tapping into ongoing processes, mounted drives or other operating system elements. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -105,23 +58,21 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true - OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, - /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR - match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true - OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true - OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, - /(?i)Get-RegistryMountedDrive/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-RegistryMountedDrive/)=true )\n\n| eval start_time = timestamp, end_time\ + \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml index ee99f06077..f13647e4fb 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery and access to services and processes. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 0243d37c-57c1-4182-bfd1-39b212255fc8 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1007 - - T1046 - - T1057 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Processes and Services via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 50 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is listing processes and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ savedsearch_annotations: @@ -89,17 +48,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true\ + \ OR match_regex(cmd_line, /(?i)service::list/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml index 52748df622..e59fd16b33 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery and access to network shares. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Shared Resources via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -94,17 +52,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)net::share/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml index ace88f6825..f72b3cbcf8 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 6b7ca431-6b1e-4b40-9589-21cb368e369e known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP name: Reconnaissance and Access to Shared Resources via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -94,21 +52,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true - OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, - /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true - OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, - /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true\ + \ OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line,\ + \ /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml index 4dd8815e53..b10528e22f 100644 --- a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, weak access control policies, landing paths for dropping malicious software or data @@ -32,33 +10,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1053 - - T1068 - - T1078 - - T1543 - - T1547 - - T1574 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 60 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is searching for an entry point into the infrastructure, such as local admin accounts, opportunities to hijack processes, unattended install files, or modifiable access objects. Operation is performed at the device $dest_device_id$, @@ -100,27 +56,24 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true - OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, - /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true - OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, - /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true - OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, - /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true - OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, - /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true - OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, - /(?i)Get-UnquotedService/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line,\ + \ /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true\ + \ OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true )\n\n| eval start_time\ + \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ + \ \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml index 4ee8fedbf5..c448efee2b 100644 --- a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies access to PowerSploit modules for reconnaissance of connectivity. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Connectivity via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is performing port scans or searching for various connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command @@ -93,23 +51,19 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true - OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, - /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true - OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, - /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true - OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true - ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,\ + \ /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true\ + \ OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml index b8cd08eaa9..5b6ec5f7ea 100644 --- a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml @@ -1,63 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 5facee5b-79e4-47ab-b0e6-c625acc0554f known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1590.001 - - T1078 - - T1589.001 - - T1590 - - T1068 - - T1589 - - T1590.003 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Credential Stores and Services via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is searching for and accessing credential stores. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -101,19 +55,16 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, - /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true - OR match_regex(cmd_line, /(?i)crypto::sc/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true\ + \ OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true\ + \ OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml index 946bc254a4..9193687816 100644 --- a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml @@ -1,59 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules for assessment of presence of defensive tools. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 24b4e659-63a2-4e7b-89ac-87dd659c7110 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592.002 - - T1595.002 - - T1592 - - T1595 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Defensive Tools via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 40 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is looking for presence of anti virus software. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,17 +50,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Find-AVSignature/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml index 0c9dcb0a02..fc3e4e0788 100644 --- a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: b9b4492c-2af8-449b-beb4-b1b78d963321 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 60 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is engaging its privilege escalation module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -90,17 +49,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Invoke-PrivescAudit/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml index 1c935ced80..2d3cbadadf 100644 --- a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml @@ -1,28 +1,6 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-05' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft Detours is an open source library for intercepting, monitoring and instrumenting @@ -33,31 +11,12 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in including the event ID 4688 with enabled command line logging. id: fc5c1cbd-7494-4314-aad2-458d6fd4fada known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1543 - - T1055 - - T1574 - nist: - - PR.AC - - PR.IP name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz - https://en.wikipedia.org/wiki/Microsoft_Detours -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 70 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -97,17 +56,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)misc::detours/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/resize_shadowstorage_volume.yml index 57ffdafbaf..b7a6a1f554 100644 --- a/dist/ssa/detections/resize_shadowstorage_volume.yml +++ b/dist/ssa/detections/resize_shadowstorage_volume.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-21' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive @@ -36,24 +14,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. id: dbc30554-d27e-11eb-9e5e-acde48001122 known_false_positives: network admin can resize the shadowstorage for valid purposes. -mappings: - cis20: - - CIS 10 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP name: Resize Shadowstorage Volume product: - Splunk Behavioral Analytics references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -risk: [] savedsearch_annotations: analytic_story: - Clop Ransomware @@ -68,19 +34,19 @@ savedsearch_annotations: nist: - PR.DS - PR.IP -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") - AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), - "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, - "parent_process_name", parent_process_name, "process_path", process_path]) | into - write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%resize%\") AND like(cmd_line,\ + \ \"%shadowstorage%\") AND like(cmd_line, \"%maxsize%\") AND process_name=\"vssadmin.exe\"\ + \ \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - Clop Ransomware diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml index 6f0b603b48..c8cfc0871e 100644 --- a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies illegal setting of credentials via DSInternals modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Setting Credentials via DSInternals modules product: - Splunk Behavioral Analytics references: - https://github.com/MichaelGrafnetter/DSInternals -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: DSInternals malware is accessing, using or setting Active Directory or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -92,23 +51,21 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, - "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true - OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true - OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, - /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true - OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ + , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true\ + \ OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true\ + \ OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line,\ + \ /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml index df0157fb77..8f8f8ee2b2 100644 --- a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies illegal setting of credentials via Mimikatz modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: c8b84699-7652-4363-910f-efd1ca82f780 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Setting Credentials via Mimikatz modules product: - Splunk Behavioral Analytics references: - https://github.com/gentilkiwi/mimikatz -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 80 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: Mimikatz malware is accessing, using or setting account credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -91,17 +50,15 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true\ + \ OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )\n\n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml index 7c9d4b0d78..4cf8dda9da 100644 --- a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml @@ -1,58 +1,17 @@ author: Stanislav Miskovic, Splunk datamodel: [] date: '2020-11-03' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This detection identifies illegal setting of credentials via PowerSploit modules. how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. id: 07b2a501-f967-4ddc-9f56-2dce46dfce44 known_false_positives: None identified. -mappings: - cis20: - - CIS 16 - - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP name: Setting Credentials via PowerSploit modules product: - Splunk Behavioral Analytics references: - https://github.com/PowerShellMafia/PowerSploit -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 90 -- threat_object_field: cmd_line - threat_object_type: processname risk_message: PowerSploit malware is setting passwords on Active Directory accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ @@ -91,17 +50,14 @@ savedsearch_annotations: role: - Others type: processname -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, - /(?i)Set-DomainUserPassword/)=true ) - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true\ + \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ + \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ + \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/system_process_running_from_unexpected_location.yml index 7722e2d723..66246da68e 100644 --- a/dist/ssa/detections/system_process_running_from_unexpected_location.yml +++ b/dist/ssa/detections/system_process_running_from_unexpected_location.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2020-08-25' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the process from a different folder. This detection checks that a list of system processes @@ -32,27 +10,10 @@ description: An attacker tries might try to use different version of a system co how_to_implement: Collect endpoint data such as sysmon or 4688 events. id: 28179107-099a-464a-94d3-08301e6c055f known_false_positives: None -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1036 - nist: - - PR.PT - - DE.CM name: System Process Running from Unexpected Location product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 56 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 56 risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ savedsearch_annotations: @@ -82,223 +43,249 @@ savedsearch_annotations: role: - Victim type: user -search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), - "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", - null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); - - $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" - OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" - OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" - OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" - OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" - OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" - OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" - OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" - OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" - OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR - process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR - process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" - OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR - process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" - OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" - OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR - process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" - OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" - OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" - OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" - OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" - OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" - OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" - OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" - OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" - OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR - process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" - OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" - OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" - OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" - OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" - OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" - OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" - OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" - OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" - OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" - OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; - - $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" - OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" - OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" - OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" - OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" - OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR - process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" - OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR - process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" - OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" - OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" - OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" - OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" - OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" - OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR - process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" - OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" - OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" - OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" - OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" - OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" - OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" - OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" - OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" - OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" - OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" - OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" - OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" - OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" - OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR - process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR - process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" - OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" - OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" - OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" - OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" - OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" - OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" - OR process_name="windowsanytimeupgraderesults.exe"; - - $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR - process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" - OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" - OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" - OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" - OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" - OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" - OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" - OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" - OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" - OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" - OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" - OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" - OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" - OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" - OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" - OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" - OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" - OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" - OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" - OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" - OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" - OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" - OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" - OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" - OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" - OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" - OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" - OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" - OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" - OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" - OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" - OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" - OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" - OR process_name="easinvoker.exe" OR process_name="efsui.exe"; - - $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" - OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" - OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" - OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" - OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" - OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" - OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" - OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" - OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" - OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" - OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" - OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" - OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" - OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" - OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" - OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" - OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" - OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" - OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" - OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" - OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" - OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" - OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" - OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" - OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" - OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" - OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" - OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" - OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" - OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" - OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" - OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" - OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" - OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; - - $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" - OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" - OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" - OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" - OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" - OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" - OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" - OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" - OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" - OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" - OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" - OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" - OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" - OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" - OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" - OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" - OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" - OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" - OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" - OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" - OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" - OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" - OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" - OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" - OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" - OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" - OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" - OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" - OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" - OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" - OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" - OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" - OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" - OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; - - $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" - OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" - OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" - OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" - OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" - OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" - OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" - OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" - OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" - OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" - OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" - OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" - OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" - OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" - OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" - OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" - OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" - OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" - OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" - OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; - - | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | - union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false - AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", - event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' +search: " $ssa_input = \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\ + \ \"dest_device_id\"), \"string\", null), user=ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=lower(ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null);\n$cond_1 = \n| from $ssa_input \n| where process_name=\"arp.exe\" OR process_name=\"\ + adaptertroubleshooter.exe\" OR process_name=\"applicationframehost.exe\" OR process_name=\"\ + atbroker.exe\" OR process_name=\"authhost.exe\" OR process_name=\"autoworkplace.exe\"\ + \ OR process_name=\"axinstui.exe\" OR process_name=\"backgroundtransferhost.exe\"\ + \ OR process_name=\"bdehdcfg.exe\" OR process_name=\"bdeuisrv.exe\" OR process_name=\"\ + bdeunlockwizard.exe\" OR process_name=\"bitlockerdeviceencryption.exe\" OR process_name=\"\ + bitlockerwizard.exe\" OR process_name=\"bitlockerwizardelev.exe\" OR process_name=\"\ + bytecodegenerator.exe\" OR process_name=\"camerasettingsuihost.exe\" OR process_name=\"\ + castsrv.exe\" OR process_name=\"certenrollctrl.exe\" OR process_name=\"checknetisolation.exe\"\ + \ OR process_name=\"clipup.exe\" OR process_name=\"cloudexperiencehostbroker.exe\"\ + \ OR process_name=\"cloudnotifications.exe\" OR process_name=\"cloudstoragewizard.exe\"\ + \ OR process_name=\"compmgmtlauncher.exe\" OR process_name=\"compattelrunner.exe\"\ + \ OR process_name=\"computerdefaults.exe\" OR process_name=\"credentialuibroker.exe\"\ + \ OR process_name=\"dfdwiz.exe\" OR process_name=\"dwwin.exe\" OR process_name=\"\ + dataexchangehost.exe\" OR process_name=\"defrag.exe\" OR process_name=\"devicedisplayobjectprovider.exe\"\ + \ OR process_name=\"deviceeject.exe\" OR process_name=\"deviceenroller.exe\" OR\ + \ process_name=\"devicepairingwizard.exe\" OR process_name=\"deviceproperties.exe\"\ + \ OR process_name=\"disksnapshot.exe\" OR process_name=\"dism.exe\" OR process_name=\"\ + displayswitch.exe\" OR process_name=\"dmnotificationbroker.exe\" OR process_name=\"\ + dmomacpmo.exe\" OR process_name=\"dpiscaling.exe\" OR process_name=\"dsmusertask.exe\"\ + \ OR process_name=\"dxpserver.exe\" OR process_name=\"edpcleanup.exe\" OR process_name=\"\ + eosnotify.exe\" OR process_name=\"eap3host.exe\" OR process_name=\"easpoliciesbrokerhost.exe\"\ + \ OR process_name=\"easeofaccessdialog.exe\" OR process_name=\"ehstorauthn.exe\"\ + \ OR process_name=\"fxscover.exe\" OR process_name=\"fxssvc.exe\" OR process_name=\"\ + fxsunatd.exe\" OR process_name=\"filehistory.exe\" OR process_name=\"fondue.exe\"\ + \ OR process_name=\"gamepanel.exe\" OR process_name=\"genvalobj.exe\" OR process_name=\"\ + gettingstarted.exe\" OR process_name=\"hostname.exe\" OR process_name=\"icsentitlementhost.exe\"\ + \ OR process_name=\"infdefaultinstall.exe\" OR process_name=\"installagent.exe\"\ + \ OR process_name=\"languagecomponentsinstallercomhandler.exe\" OR process_name=\"\ + launchtm.exe\" OR process_name=\"launchwinapp.exe\" OR process_name=\"legacynetuxhost.exe\"\ + \ OR process_name=\"licensemanagershellext.exe\" OR process_name=\"licensingui.exe\"\ + \ OR process_name=\"locationnotificationwindows.exe\" OR process_name=\"locationnotifications.exe\"\ + \ OR process_name=\"locator.exe\" OR process_name=\"lockapphost.exe\" OR process_name=\"\ + lockscreencontentserver.exe\" OR process_name=\"logonui.exe\" OR process_name=\"\ + lsaiso.exe\" OR process_name=\"mdeserver.exe\" OR process_name=\"mdmagent.exe\"\ + \ OR process_name=\"mdmappinstaller.exe\" OR process_name=\"mrinfo.exe\" OR process_name=\"\ + mrt.exe\" OR process_name=\"mschedexe.exe\" OR process_name=\"magnify.exe\" OR process_name=\"\ + mbaeparsertask.exe\" OR process_name=\"mdres.exe\" OR process_name=\"mdsched.exe\"\ + \ OR process_name=\"migautoplay.exe\" OR process_name=\"mpsigstub.exe\" OR process_name=\"\ + msspellcheckinghost.exe\" OR process_name=\"muiunattend.exe\" OR process_name=\"\ + multidigimon.exe\" OR process_name=\"musnotification.exe\" OR process_name=\"musnotificationux.exe\"\ + \ OR process_name=\"napstat.exe\" OR process_name=\"netstat.exe\" OR process_name=\"\ + narrator.exe\" OR process_name=\"netcfgnotifyobjecthost.exe\" OR process_name=\"\ + netevtfwdr.exe\" OR process_name=\"netproj.exe\" OR process_name=\"netplwiz.exe\"\ + \ OR process_name=\"networkuxbroker.exe\";\n$cond_2 = \n| from $ssa_input \n| where\ + \ process_name=\"openwith.exe\" OR process_name=\"optionalfeatures.exe\" OR process_name=\"\ + pathping.exe\" OR process_name=\"ping.exe\" OR process_name=\"passwordonwakesettingflyout.exe\"\ + \ OR process_name=\"pickerhost.exe\" OR process_name=\"pkgmgr.exe\" OR process_name=\"\ + pnpunattend.exe\" OR process_name=\"pnputil.exe\" OR process_name=\"presentationhost.exe\"\ + \ OR process_name=\"presentationsettings.exe\" OR process_name=\"printbrmui.exe\"\ + \ OR process_name=\"printdialoghost.exe\" OR process_name=\"printdialoghost3d.exe\"\ + \ OR process_name=\"printisolationhost.exe\" OR process_name=\"proximityuxhost.exe\"\ + \ OR process_name=\"rdspnf.exe\" OR process_name=\"rmactivate.exe\" OR process_name=\"\ + rmactivate_isv.exe\" OR process_name=\"rmactivate_ssp.exe\" OR process_name=\"rmactivate_ssp_isv.exe\"\ + \ OR process_name=\"route.exe\" OR process_name=\"rdpsa.exe\" OR process_name=\"\ + rdpsaproxy.exe\" OR process_name=\"rdpsauachelper.exe\" OR process_name=\"reagentc.exe\"\ + \ OR process_name=\"recoverydrive.exe\" OR process_name=\"register-cimprovider.exe\"\ + \ OR process_name=\"registeriepkeys.exe\" OR process_name=\"relpost.exe\" OR process_name=\"\ + remoteposworker.exe\" OR process_name=\"rmclient.exe\" OR process_name=\"robocopy.exe\"\ + \ OR process_name=\"rpcping.exe\" OR process_name=\"runlegacycplelevated.exe\" OR\ + \ process_name=\"runtimebroker.exe\" OR process_name=\"sihclient.exe\" OR process_name=\"\ + searchfilterhost.exe\" OR process_name=\"searchindexer.exe\" OR process_name=\"\ + searchprotocolhost.exe\" OR process_name=\"secedit.exe\" OR process_name=\"sensordataservice.exe\"\ + \ OR process_name=\"setieinstalleddate.exe\" OR process_name=\"settingsynchost.exe\"\ + \ OR process_name=\"slidetoshutdown.exe\" OR process_name=\"smartscreensettings.exe\"\ + \ OR process_name=\"sndvol.exe\" OR process_name=\"snippingtool.exe\" OR process_name=\"\ + soundrecorder.exe\" OR process_name=\"spaceagent.exe\" OR process_name=\"sppextcomobj.exe\"\ + \ OR process_name=\"srtasks.exe\" OR process_name=\"stikynot.exe\" OR process_name=\"\ + synchost.exe\" OR process_name=\"sysreseterr.exe\" OR process_name=\"systempropertiesadvanced.exe\"\ + \ OR process_name=\"systempropertiescomputername.exe\" OR process_name=\"systempropertiesdataexecutionprevention.exe\"\ + \ OR process_name=\"systempropertieshardware.exe\" OR process_name=\"systempropertiesperformance.exe\"\ + \ OR process_name=\"systempropertiesprotection.exe\" OR process_name=\"systempropertiesremote.exe\"\ + \ OR process_name=\"systemsettingsadminflows.exe\" OR process_name=\"systemsettingsbroker.exe\"\ + \ OR process_name=\"systemsettingsremovedevice.exe\" OR process_name=\"tcpsvcs.exe\"\ + \ OR process_name=\"tracert.exe\" OR process_name=\"tstheme.exe\" OR process_name=\"\ + tswbprxy.exe\" OR process_name=\"tapiunattend.exe\" OR process_name=\"taskmgr.exe\"\ + \ OR process_name=\"thumbnailextractionhost.exe\" OR process_name=\"tokenbrokercookies.exe\"\ + \ OR process_name=\"tpminit.exe\" OR process_name=\"tswpfwrp.exe\" OR process_name=\"\ + ui0detect.exe\" OR process_name=\"upgraderesultsui.exe\" OR process_name=\"useraccountbroker.exe\"\ + \ OR process_name=\"useraccountcontrolsettings.exe\" OR process_name=\"usoclient.exe\"\ + \ OR process_name=\"utilman.exe\" OR process_name=\"vssvc.exe\" OR process_name=\"\ + vaultcmd.exe\" OR process_name=\"vaultsysui.exe\" OR process_name=\"wfs.exe\" OR\ + \ process_name=\"wmpdmc.exe\" OR process_name=\"wpdshextautoplay.exe\" OR process_name=\"\ + wscollect.exe\" OR process_name=\"wsmanhttpconfig.exe\" OR process_name=\"wsreset.exe\"\ + \ OR process_name=\"wudfhost.exe\" OR process_name=\"wwahost.exe\" OR process_name=\"\ + wallpaperhost.exe\" OR process_name=\"webcache.exe\" OR process_name=\"werfault.exe\"\ + \ OR process_name=\"werfaultsecure.exe\" OR process_name=\"winsat.exe\" OR process_name=\"\ + windows.media.backgroundplayback.exe\" OR process_name=\"windowsactiondialog.exe\"\ + \ OR process_name=\"windowsanytimeupgrade.exe\" OR process_name=\"windowsanytimeupgraderesults.exe\"\ + ;\n$cond_3 = \n| from $ssa_input \n| where process_name=\"windowsanytimeupgradeui.exe\"\ + \ OR process_name=\"windowsupdateelevatedinstaller.exe\" OR process_name=\"workfolders.exe\"\ + \ OR process_name=\"wpcmon.exe\" OR process_name=\"acu.exe\" OR process_name=\"\ + aitagent.exe\" OR process_name=\"aitstatic.exe\" OR process_name=\"alg.exe\" OR\ + \ process_name=\"appidcertstorecheck.exe\" OR process_name=\"appidpolicyconverter.exe\"\ + \ OR process_name=\"at.exe\" OR process_name=\"attrib.exe\" OR process_name=\"audiodg.exe\"\ + \ OR process_name=\"auditpol.exe\" OR process_name=\"autochk.exe\" OR process_name=\"\ + autoconv.exe\" OR process_name=\"autofmt.exe\" OR process_name=\"baaupdate.exe\"\ + \ OR process_name=\"backgroundtaskhost.exe\" OR process_name=\"bcastdvr.exe\" OR\ + \ process_name=\"bcdboot.exe\" OR process_name=\"bcdedit.exe\" OR process_name=\"\ + bdechangepin.exe\" OR process_name=\"bdeunlock.exe\" OR process_name=\"bitsadmin.exe\"\ + \ OR process_name=\"bootcfg.exe\" OR process_name=\"bootim.exe\" OR process_name=\"\ + bootsect.exe\" OR process_name=\"bridgeunattend.exe\" OR process_name=\"browser_broker.exe\"\ + \ OR process_name=\"bthudtask.exe\" OR process_name=\"cacls.exe\" OR process_name=\"\ + calc.exe\" OR process_name=\"cdpreference.exe\" OR process_name=\"certreq.exe\"\ + \ OR process_name=\"certutil.exe\" OR process_name=\"change.exe\" OR process_name=\"\ + changepk.exe\" OR process_name=\"charmap.exe\" OR process_name=\"chglogon.exe\"\ + \ OR process_name=\"chgport.exe\" OR process_name=\"chgusr.exe\" OR process_name=\"\ + chkdsk.exe\" OR process_name=\"chkntfs.exe\" OR process_name=\"choice.exe\" OR process_name=\"\ + cipher.exe\" OR process_name=\"cleanmgr.exe\" OR process_name=\"cliconfg.exe\" OR\ + \ process_name=\"clip.exe\" OR process_name=\"cmd.exe\" OR process_name=\"cmdkey.exe\"\ + \ OR process_name=\"cmdl32.exe\" OR process_name=\"cmmon32.exe\" OR process_name=\"\ + cmstp.exe\" OR process_name=\"cofire.exe\" OR process_name=\"colorcpl.exe\" OR process_name=\"\ + comp.exe\" OR process_name=\"compact.exe\" OR process_name=\"conhost.exe\" OR process_name=\"\ + consent.exe\" OR process_name=\"control.exe\" OR process_name=\"convert.exe\" OR\ + \ process_name=\"credwiz.exe\" OR process_name=\"cscript.exe\" OR process_name=\"\ + csrss.exe\" OR process_name=\"ctfmon.exe\" OR process_name=\"cttune.exe\" OR process_name=\"\ + cttunesvr.exe\" OR process_name=\"dashost.exe\" OR process_name=\"dccw.exe\" OR\ + \ process_name=\"dcomcnfg.exe\" OR process_name=\"ddodiag.exe\" OR process_name=\"\ + dfrgui.exe\" OR process_name=\"dialer.exe\" OR process_name=\"diantz.exe\" OR process_name=\"\ + dinotify.exe\" OR process_name=\"diskpart.exe\" OR process_name=\"diskperf.exe\"\ + \ OR process_name=\"diskraid.exe\" OR process_name=\"dispdiag.exe\" OR process_name=\"\ + djoin.exe\" OR process_name=\"dllhost.exe\" OR process_name=\"dllhst3g.exe\" OR\ + \ process_name=\"dmcertinst.exe\" OR process_name=\"dmcfghost.exe\" OR process_name=\"\ + dmclient.exe\" OR process_name=\"dnscacheugc.exe\" OR process_name=\"doskey.exe\"\ + \ OR process_name=\"dpapimig.exe\" OR process_name=\"dpnsvr.exe\" OR process_name=\"\ + driverquery.exe\" OR process_name=\"drvcfg.exe\" OR process_name=\"drvinst.exe\"\ + \ OR process_name=\"dsregcmd.exe\" OR process_name=\"dstokenclean.exe\" OR process_name=\"\ + dvdplay.exe\" OR process_name=\"dvdupgrd.exe\" OR process_name=\"dwm.exe\" OR process_name=\"\ + dxdiag.exe\" OR process_name=\"easinvoker.exe\" OR process_name=\"efsui.exe\";\n\ + $cond_4 = \n| from $ssa_input \n| where process_name=\"embeddedapplauncher.exe\"\ + \ OR process_name=\"esentutl.exe\" OR process_name=\"eudcedit.exe\" OR process_name=\"\ + eventcreate.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"expand.exe\"\ + \ OR process_name=\"extrac32.exe\" OR process_name=\"fc.exe\" OR process_name=\"\ + fhmanagew.exe\" OR process_name=\"find.exe\" OR process_name=\"findstr.exe\" OR\ + \ process_name=\"finger.exe\" OR process_name=\"fixmapi.exe\" OR process_name=\"\ + fltmc.exe\" OR process_name=\"fodhelper.exe\" OR process_name=\"fontdrvhost.exe\"\ + \ OR process_name=\"fontview.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"\ + fsavailux.exe\" OR process_name=\"fsquirt.exe\" OR process_name=\"fsutil.exe\" OR\ + \ process_name=\"ftp.exe\" OR process_name=\"fvenotify.exe\" OR process_name=\"\ + fveprompt.exe\" OR process_name=\"getmac.exe\" OR process_name=\"gpresult.exe\"\ + \ OR process_name=\"gpscript.exe\" OR process_name=\"gpupdate.exe\" OR process_name=\"\ + grpconv.exe\" OR process_name=\"hdwwiz.exe\" OR process_name=\"help.exe\" OR process_name=\"\ + hwrcomp.exe\" OR process_name=\"hwrreg.exe\" OR process_name=\"icacls.exe\" OR process_name=\"\ + icardagt.exe\" OR process_name=\"icsunattend.exe\" OR process_name=\"ie4uinit.exe\"\ + \ OR process_name=\"ieunatt.exe\" OR process_name=\"ieetwcollector.exe\" OR process_name=\"\ + iexpress.exe\" OR process_name=\"immersivetpmvscmgrsvr.exe\" OR process_name=\"\ + ipconfig.exe\" OR process_name=\"irftp.exe\" OR process_name=\"iscsicli.exe\" OR\ + \ process_name=\"iscsicpl.exe\" OR process_name=\"isoburn.exe\" OR process_name=\"\ + klist.exe\" OR process_name=\"ksetup.exe\" OR process_name=\"ktmutil.exe\" OR process_name=\"\ + label.exe\" OR process_name=\"licensingdiag.exe\" OR process_name=\"lodctr.exe\"\ + \ OR process_name=\"logagent.exe\" OR process_name=\"logman.exe\" OR process_name=\"\ + logoff.exe\" OR process_name=\"lpkinstall.exe\" OR process_name=\"lpksetup.exe\"\ + \ OR process_name=\"lpremove.exe\" OR process_name=\"lsass.exe\" OR process_name=\"\ + lsm.exe\" OR process_name=\"makecab.exe\" OR process_name=\"manage-bde.exe\" OR\ + \ process_name=\"mblctr.exe\" OR process_name=\"mcbuilder.exe\" OR process_name=\"\ + mctadmin.exe\" OR process_name=\"mfpmp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"\ + mobsync.exe\" OR process_name=\"mountvol.exe\" OR process_name=\"mpnotify.exe\"\ + \ OR process_name=\"msconfig.exe\" OR process_name=\"msdt.exe\" OR process_name=\"\ + msdtc.exe\" OR process_name=\"msfeedssync.exe\" OR process_name=\"msg.exe\" OR process_name=\"\ + mshta.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"msinfo32.exe\" OR\ + \ process_name=\"mspaint.exe\" OR process_name=\"msra.exe\" OR process_name=\"mstsc.exe\"\ + \ OR process_name=\"mtstocom.exe\" OR process_name=\"nbtstat.exe\" OR process_name=\"\ + ndadmin.exe\" OR process_name=\"net.exe\" OR process_name=\"net1.exe\" OR process_name=\"\ + netbtugc.exe\" OR process_name=\"netcfg.exe\" OR process_name=\"netiougc.exe\" OR\ + \ process_name=\"netsh.exe\" OR process_name=\"newdev.exe\" OR process_name=\"nltest.exe\"\ + \ OR process_name=\"notepad.exe\" OR process_name=\"nslookup.exe\" OR process_name=\"\ + ntoskrnl.exe\" OR process_name=\"ntprint.exe\" OR process_name=\"ocsetup.exe\" OR\ + \ process_name=\"odbcad32.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"\ + omadmclient.exe\" OR process_name=\"omadmprc.exe\";\n$cond_5 = \n| from $ssa_input\ + \ \n| where process_name=\"openfiles.exe\" OR process_name=\"osk.exe\" OR process_name=\"\ + p2phost.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"pcaui.exe\" OR process_name=\"\ + pcawrk.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"perfmon.exe\" OR process_name=\"\ + phoneactivate.exe\" OR process_name=\"plasrv.exe\" OR process_name=\"poqexec.exe\"\ + \ OR process_name=\"powercfg.exe\" OR process_name=\"prevhost.exe\" OR process_name=\"\ + print.exe\" OR process_name=\"printfilterpipelinesvc.exe\" OR process_name=\"printui.exe\"\ + \ OR process_name=\"proquota.exe\" OR process_name=\"provtool.exe\" OR process_name=\"\ + psr.exe\" OR process_name=\"pwlauncher.exe\" OR process_name=\"qappsrv.exe\" OR\ + \ process_name=\"qprocess.exe\" OR process_name=\"query.exe\" OR process_name=\"\ + quser.exe\" OR process_name=\"qwinsta.exe\" OR process_name=\"rasautou.exe\" OR\ + \ process_name=\"rasdial.exe\" OR process_name=\"raserver.exe\" OR process_name=\"\ + rasphone.exe\" OR process_name=\"rdpclip.exe\" OR process_name=\"rdpinput.exe\"\ + \ OR process_name=\"rdrleakdiag.exe\" OR process_name=\"recdisc.exe\" OR process_name=\"\ + recover.exe\" OR process_name=\"reg.exe\" OR process_name=\"regedt32.exe\" OR process_name=\"\ + regini.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"rekeywiz.exe\" OR\ + \ process_name=\"relog.exe\" OR process_name=\"repair-bde.exe\" OR process_name=\"\ + replace.exe\" OR process_name=\"reset.exe\" OR process_name=\"resmon.exe\" OR process_name=\"\ + rmttpmvscmgrsvr.exe\" OR process_name=\"rrinstaller.exe\" OR process_name=\"rstrui.exe\"\ + \ OR process_name=\"runas.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"\ + runonce.exe\" OR process_name=\"rwinsta.exe\" OR process_name=\"sbunattend.exe\"\ + \ OR process_name=\"sc.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"\ + sdbinst.exe\" OR process_name=\"sdchange.exe\" OR process_name=\"sdclt.exe\" OR\ + \ process_name=\"sdiagnhost.exe\" OR process_name=\"secinit.exe\" OR process_name=\"\ + services.exe\" OR process_name=\"sessionmsg.exe\" OR process_name=\"sethc.exe\"\ + \ OR process_name=\"setspn.exe\" OR process_name=\"setupcl.exe\" OR process_name=\"\ + setupugc.exe\" OR process_name=\"setx.exe\" OR process_name=\"sfc.exe\" OR process_name=\"\ + shadow.exe\" OR process_name=\"shrpubw.exe\" OR process_name=\"shutdown.exe\" OR\ + \ process_name=\"sigverif.exe\" OR process_name=\"sihost.exe\" OR process_name=\"\ + slui.exe\" OR process_name=\"smss.exe\" OR process_name=\"snmptrap.exe\" OR process_name=\"\ + sort.exe\" OR process_name=\"spinstall.exe\" OR process_name=\"spoolsv.exe\" OR\ + \ process_name=\"sppsvc.exe\" OR process_name=\"spreview.exe\" OR process_name=\"\ + srdelayed.exe\" OR process_name=\"subst.exe\" OR process_name=\"svchost.exe\" OR\ + \ process_name=\"sxstrace.exe\" OR process_name=\"syskey.exe\" OR process_name=\"\ + systeminfo.exe\" OR process_name=\"systemreset.exe\" OR process_name=\"systray.exe\"\ + \ OR process_name=\"tabcal.exe\" OR process_name=\"takeown.exe\" OR process_name=\"\ + taskeng.exe\" OR process_name=\"taskhost.exe\" OR process_name=\"taskhostw.exe\"\ + \ OR process_name=\"taskkill.exe\" OR process_name=\"tasklist.exe\" OR process_name=\"\ + taskmgr.exe\" OR process_name=\"tcmsetup.exe\" OR process_name=\"timeout.exe\" OR\ + \ process_name=\"tpmvscmgr.exe\" OR process_name=\"tpmvscmgrsvr.exe\";\n$cond_6\ + \ = \n| from $ssa_input \n| where process_name=\"tracerpt.exe\" OR process_name=\"\ + tscon.exe\" OR process_name=\"tsdiscon.exe\" OR process_name=\"tskill.exe\" OR process_name=\"\ + typeperf.exe\" OR process_name=\"tzsync.exe\" OR process_name=\"tzutil.exe\" OR\ + \ process_name=\"ucsvc.exe\" OR process_name=\"unlodctr.exe\" OR process_name=\"\ + unregmp2.exe\" OR process_name=\"upnpcont.exe\" OR process_name=\"userinit.exe\"\ + \ OR process_name=\"vds.exe\" OR process_name=\"vdsldr.exe\" OR process_name=\"\ + verclsid.exe\" OR process_name=\"verifier.exe\" OR process_name=\"verifiergui.exe\"\ + \ OR process_name=\"vmicsvc.exe\" OR process_name=\"vssadmin.exe\" OR process_name=\"\ + w32tm.exe\" OR process_name=\"waitfor.exe\" OR process_name=\"wbadmin.exe\" OR process_name=\"\ + wbengine.exe\" OR process_name=\"wecutil.exe\" OR process_name=\"wermgr.exe\" OR\ + \ process_name=\"wevtutil.exe\" OR process_name=\"wextract.exe\" OR process_name=\"\ + where.exe\" OR process_name=\"whoami.exe\" OR process_name=\"wiaacmgr.exe\" OR process_name=\"\ + wiawow64.exe\" OR process_name=\"wifitask.exe\" OR process_name=\"wimserv.exe\"\ + \ OR process_name=\"wininit.exe\" OR process_name=\"winload.exe\" OR process_name=\"\ + winlogon.exe\" OR process_name=\"winresume.exe\" OR process_name=\"winrs.exe\" OR\ + \ process_name=\"winrshost.exe\" OR process_name=\"winver.exe\" OR process_name=\"\ + wisptis.exe\" OR process_name=\"wkspbroker.exe\" OR process_name=\"wksprt.exe\"\ + \ OR process_name=\"wlanext.exe\" OR process_name=\"wlrmdr.exe\" OR process_name=\"\ + wowreg32.exe\" OR process_name=\"wpnpinst.exe\" OR process_name=\"wpr.exe\" OR process_name=\"\ + write.exe\" OR process_name=\"wscript.exe\" OR process_name=\"wsmprovhost.exe\"\ + \ OR process_name=\"wsqmcons.exe\" OR process_name=\"wuapihost.exe\" OR process_name=\"\ + wuapp.exe\" OR process_name=\"wuauclt.exe\" OR process_name=\"wusa.exe\" OR process_name=\"\ + xcopy.exe\" OR process_name=\"xpsrchvw.exe\" OR process_name=\"xwizard.exe\";\n\n\ + | from $cond_1 \n| union $cond_2 \n| union $cond_3 \n| union $cond_4 \n| union $cond_5\ + \ \n| union $cond_6 \n| where match_regex(process_path, /(?i)\\\\windows\\\\system32/)=false\ + \ AND match_regex(process_path, /(?i)\\\\windows\\\\syswow64/)=false \n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(device, user), body=create_map([\"event_id\"\ + , event_id, \"process_path\", process_path, \"process_name\", process_name]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Windows Defense Evasion Tactics diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/unusually_long_command_line.yml index 9338c1af46..a91f69f5ed 100644 --- a/dist/ssa/detections/unusually_long_command_line.yml +++ b/dist/ssa/detections/unusually_long_command_line.yml @@ -1,28 +1,6 @@ author: Ignacio Bermudez Corrales, Splunk datamodel: [] date: '2020-10-06' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin to help identify command lines with lengths that are unusual for a given user. This @@ -36,25 +14,10 @@ known_false_positives: This detection may flag suspiciously long command lines w for the tracked process. Also, some legitimate applications may use long command lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. Attackers may use this technique to obfuscate their payloads. -mappings: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - nist: - - PR.PT - - DE.CM name: Unusually Long Command Line product: - Splunk Behavioral Analytics references: [] -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 12 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 12 risk_message: A process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ savedsearch_annotations: @@ -81,20 +44,23 @@ savedsearch_annotations: role: - Victim type: user -search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval - cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, - /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, - ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, - input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 - | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", - "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", - event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' +search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)) \n| eval cmd_line=ucast(map_get(input_event, \"\ + process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line!=null and dest_user_id!=null \n| eval cmd_line_norm=replace(cast(cmd_line,\ + \ \"string\"), /\\s(--?\\w+)\n|(\\/\\w+)/, \" ARG\"), cmd_line_norm=replace(cmd_line_norm,\ + \ /\\w:\\\\[^\\s]+/, \"PATH\"), cmd_line_norm=replace(cmd_line_norm, /\\d+/, \"\ + N\"), input=parse_double(len(coalesce(cmd_line_norm, \"\"))) \n| select timestamp,\ + \ process_name, dest_device_id, dest_user_id, cmd_line, input \n| adaptive_threshold\ + \ algorithm=\"quantile\" entity=\"process_name\" window=60480000 \n| where label\ + \ AND quantile>0.99 \n| first_time_event input_columns=[\"dest_device_id\", \"cmd_line\"\ + ] \n| where first_time_dest_device_id_cmd_line \n| eval start_time = timestamp,\ + \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\ + event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\ + | into write_ssa_detected_events();" tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml index df1f647b78..04b8afba0e 100644 --- a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. @@ -35,30 +13,11 @@ how_to_implement: You must be ingesting data that records process activity from id: 5438113c-cdd9-11eb-93b8-acde48001122 known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. -mappings: - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1070 - - T1070.001 - nist: - - PR.DS - - PR.IP name: WevtUtil Usage To Clear Logs product: - Splunk Behavioral Analytics references: - https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 63 risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ savedsearch_annotations: @@ -91,20 +50,21 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, - /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, - /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, - /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% cl %\") AND (match_regex(cmd_line,\ + \ /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,\ + \ /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,\ + \ /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name=\"\ + wevtutil.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Log Manipulation diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml index bc72c7e903..6bc759ee40 100644 --- a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml @@ -2,28 +2,6 @@ author: Teoderick Contreras, Splunk datamodel: - Endpoint date: '2021-06-15' -deployment: - alert_action: - notable: - nes_fields: - - user - - dest - - src - rule_description: '%description%' - rule_title: '%name%' - author: Bhavin Patel - date: '2020-04-27' - description: This configuration file applies to all correlation searches that are - used for detection - id: bc91a8cd-35e7-4bb2-6140-e756cc46f212 - name: Enterprise Security deployment configuration - scheduling: - cron_schedule: 0 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto - tags: - analytic_story: all description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. @@ -35,30 +13,11 @@ how_to_implement: You must be ingesting data that records process activity from id: a4bdc944-cdd9-11eb-ac97-acde48001122 known_false_positives: network operator may disable audit event logs for debugging purposes. -mappings: - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1070 - - T1070.001 - nist: - - PR.DS - - PR.IP name: Wevtutil Usage To Disable Logs product: - Splunk Behavioral Analytics references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -risk: -- risk_object_field: dest_device_id - risk_object_type: system - risk_score: 63 -- risk_object_field: dest_user_id - risk_object_type: user - risk_score: 63 risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ savedsearch_annotations: @@ -90,17 +49,19 @@ savedsearch_annotations: role: - Victim type: user -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null), process_name=ucast(map_get(input_event, "process_name"), "string", null), - process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), - "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, - "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, - entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, - "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", - cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, - "process_path", process_path]) | into write_ssa_detected_events();' +search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ + ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ + \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ + \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% sl %\") AND like(cmd_line,\ + \ \"%/e:false%\") AND process_name=\"wevtutil.exe\" \n| eval start_time=timestamp,\ + \ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\ + ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ + , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ + , process_name, \"parent_process_name\", parent_process_name, \"process_path\",\ + \ process_path]) \n| into write_ssa_detected_events();" tags: analytic_story: - Windows Log Manipulation From 3237b98c0b997103c6fd4d2fd9779622e8baac5a Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 1 Nov 2021 18:58:09 -0400 Subject: [PATCH 4/7] remove pretty search --- bin/generate.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index f9f3b2b394..fe372e22be 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -109,9 +109,6 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH): del d['deployment'] del d['mappings'] - # pretty search - d['search'] = d['search'].replace("|", "\n|") - with open(manifest_file, 'w') as file: documents = yaml.dump(d, file, sort_keys=True) From 19a159802c869b510ee016c5a8913bbedb71b967 Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 1 Nov 2021 20:01:33 -0400 Subject: [PATCH 5/7] updating with no savedsearches_annotations --- bin/generate.py | 1 + dist/escu/default/analyticstories.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 2 +- dist/escu/default/transforms.conf | 2 +- dist/saaws/default/analyticstories.conf | 162 ++--- dist/saaws/default/collections.conf | 2 +- dist/saaws/default/macros.conf | 74 +-- dist/saaws/default/savedsearches.conf | 592 +++++++++--------- dist/saaws/default/transforms.conf | 2 +- ...tolen_credentials_via_mimikatz_modules.yml | 63 +- ...en_credentials_via_powersploit_modules.yml | 67 +- ...ntial_strength_via_dsinternals_modules.yml | 57 +- .../detections/attempt_to_delete_services.yml | 38 +- .../attempt_to_disable_services.yml | 41 +- ...dential_dump_from_registry_via_reg_exe.yml | 61 +- ..._of_fgdump_and_cachedump_with_s_option.yml | 63 +- ..._of_fgdump_and_cachedump_with_v_option.yml | 58 +- ...cative_of_lazagne_command_line_options.yml | 51 +- ...nternals_credential_conversion_modules.yml | 68 +- ...dicative_of_use_of_dsinternals_modules.yml | 72 +-- ..._indicative_of_use_of_mimikatz_modules.yml | 61 +- ...dicative_of_use_of_powersploit_modules.yml | 63 +- ...crosoft_debuggers_peek_into_the_kernel.yml | 61 +- ...ft_debuggers_via_z_command_line_option.yml | 56 +- ...present_in_powersploit_and_dsinternals.yml | 52 +- dist/ssa/detections/delete_a_net_user.yml | 39 +- .../deny_permission_using_cacls_utility.yml | 52 +- ...detect_dump_lsass_memory_using_comsvcs.yml | 51 +- dist/ssa/detections/detect_kerberoasting.yml | 62 +- dist/ssa/detections/detect_pass_the_hash.yml | 63 +- ...ohibited_applications_spawning_cmd_exe.yml | 68 +- .../detections/disable_net_user_account.yml | 39 +- .../first_time_seen_command_line_argument.yml | 68 +- .../grant_permission_using_cacls_utility.yml | 52 +- ...o_user_content_via_powersploit_modules.yml | 62 +- ...count_creation_via_powersploit_modules.yml | 52 +- ..._deletion_of_logs_via_mimikatz_modules.yml | 53 +- ...ng_of_accounts_via_dsinternals_modules.yml | 55 +- ...s_and_policies_via_dsinternals_modules.yml | 58 +- ...ctory_elements_via_powersploit_modules.yml | 59 +- ...nd_persistence_via_powersploit_modules.yml | 62 +- ...ivilege_elevation_via_mimikatz_modules.yml | 56 +- ...d_process_control_via_mimikatz_modules.yml | 61 +- ...rocess_control_via_powersploit_modules.yml | 74 +-- ...fy_acls_permission_of_files_or_folders.yml | 48 +- ...lbas_applications_in_short_time_period.yml | 100 +-- ...ction_by_machine_learning_method_-_ssa.yml | 55 +- ...ash_observed_at_the_destination_device.yml | 81 +-- ...observed_by_an_event_collecting_device.yml | 81 +-- ...en_credentials_via_powersploit_modules.yml | 56 +- ...rare_parent-child_process_relationship.yml | 102 ++- ...counts_and_groups_via_mimikatz_modules.yml | 56 +- ...s_and_policies_via_powersploit_modules.yml | 99 +-- ...infrastructure_via_powersploit_modules.yml | 76 +-- ...rs_and_domains_via_powersploit_modules.yml | 65 +- ...cess_to_computers_via_mimikatz_modules.yml | 51 +- ...ystem_elements_via_powersploit_modules.yml | 74 +-- ...sses_and_services_via_mimikatz_modules.yml | 54 +- ..._shared_resources_via_mimikatz_modules.yml | 56 +- ...ared_resources_via_powersploit_modules.yml | 65 +- ..._opportunities_via_powersploit_modules.yml | 76 +-- ...f_connectivity_via_powersploit_modules.yml | 65 +- ...ores_and_services_via_mimikatz_modules.yml | 63 +- ...efensive_tools_via_powersploit_modules.yml | 54 +- ..._opportunities_via_powersploit_modules.yml | 53 +- ...ing_opportunities_via_mimikatz_modules.yml | 55 +- .../resize_shadowstorage_volume.yml | 40 +- ...ng_credentials_via_dsinternals_modules.yml | 68 +- ...tting_credentials_via_mimikatz_modules.yml | 55 +- ...ng_credentials_via_powersploit_modules.yml | 54 +- ...ocess_running_from_unexpected_location.yml | 487 +++++++------- .../unusually_long_command_line.yml | 55 +- .../wevtutil_usage_to_clear_logs.yml | 59 +- .../wevtutil_usage_to_disable_logs.yml | 53 +- 76 files changed, 1620 insertions(+), 3597 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index fe372e22be..446c79f3b9 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -108,6 +108,7 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH): del d['risk'] del d['deployment'] del d['mappings'] + del d['savedsearch_annotations'] with open(manifest_file, 'w') as file: documents = yaml.dump(d, file, sort_keys=True) diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index b80e3077c5..158f10beb8 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:10 UTC +# On Date: 2021-11-01T18:33:22 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 09a63bdee6..6a8b2ba871 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:10 UTC +# On Date: 2021-11-01T18:33:22 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index c6dec6c299..48e6e51fcd 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:10 UTC +# On Date: 2021-11-01T18:33:22 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index be738dd375..e60202142f 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:10 UTC +# On Date: 2021-11-01T18:33:22 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 49af384249..082d546103 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:10 UTC +# On Date: 2021-11-01T18:33:22 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index 87d25289ed..5d77956e9c 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:45 UTC +# On Date: 2021-11-01T18:33:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -26,7 +26,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -37,7 +37,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -48,7 +48,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -106,7 +106,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -119,7 +119,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -131,7 +131,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -163,6 +163,26 @@ In addition to compromising the security of your data, when bad actors leverage ### DETECTIONS ### +[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] +type = detection +asset_type = AWS Instance +confidence = medium +explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. +how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function. +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +known_false_positives = +providing_technologies = [] + +[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule] +type = detection +asset_type = AWS Instance +confidence = medium +explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. +how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +known_false_positives = +providing_technologies = [] + [savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule] type = detection asset_type = AWS Account @@ -343,46 +363,6 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] -[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] -type = detection -asset_type = AWS Instance -confidence = medium -explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. -how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function. -annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -known_false_positives = -providing_technologies = [] - -[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule] -type = detection -asset_type = Cloud Instance -confidence = medium -explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function. -annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} -known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. -providing_technologies = [] - -[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule] -type = detection -asset_type = Cloud Instance -confidence = medium -explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function. -annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} -known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. -providing_technologies = [] - -[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule] -type = detection -asset_type = AWS Instance -confidence = medium -explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. -how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. -annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -known_false_positives = -providing_technologies = [] - [savedsearch://ESCU - Cloud API Calls From Previously Unseen User Roles - Rule] type = detection asset_type = AWS Instance @@ -527,16 +507,6 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] -[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule] -type = detection -asset_type = S3 Bucket -confidence = medium -explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -how_to_implement = -annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -providing_technologies = [] - [savedsearch://ESCU - Detect New Open S3 buckets - Rule] type = detection asset_type = S3 Bucket @@ -547,14 +517,14 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. providing_technologies = [] -[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule] +[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule] type = detection -asset_type = AWS Instance +asset_type = S3 Bucket confidence = medium -explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} -known_false_positives = None +explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +how_to_implement = +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. providing_technologies = [] [savedsearch://ESCU - Detect shared ec2 snapshot - Rule] @@ -567,6 +537,16 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. providing_technologies = [] +[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule] +type = detection +asset_type = AWS Instance +confidence = medium +explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} +known_false_positives = None +providing_technologies = [] + [savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule] type = detection asset_type = Office 365 @@ -677,10 +657,38 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule] +type = detection +asset_type = Cloud Instance +confidence = medium +explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. +how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} +known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. +providing_technologies = [] + +[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule] +type = detection +asset_type = Cloud Instance +confidence = medium +explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. +how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} +known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. +providing_technologies = [] + ### END DETECTIONS ### ### RESPONSE TASKS ### +[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] +type = investigation +explanation = none +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs. +known_false_positives = not defined +earliest_time_offset = 14400 +latest_time_offset = 0 + [savedsearch://ESCU - AWS Investigate Security Hub alerts by dest - Response Task] type = investigation explanation = none @@ -689,7 +697,7 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task] +[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task] type = investigation explanation = none how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. @@ -697,7 +705,7 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task] +[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task] type = investigation explanation = none how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. @@ -729,14 +737,6 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] -type = investigation -explanation = none -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs. -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - [savedsearch://ESCU - Get All AWS Activity From City - Response Task] type = investigation explanation = none @@ -785,14 +785,6 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task] -type = investigation -explanation = none -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - [savedsearch://ESCU - Investigate AWS activities via region name - Response Task] type = investigation explanation = none @@ -801,4 +793,12 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 +[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task] +type = investigation +explanation = none +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives = not defined +earliest_time_offset = 14400 +latest_time_offset = 0 + ### END RESPONSE TASKS ### diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 5c6a29da87..0611bc763a 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:45 UTC +# On Date: 2021-11-01T18:33:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index 9bd6ecc18f..129508c1ee 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:45 UTC +# On Date: 2021-11-01T18:33:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -483,6 +483,18 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = index=zeek sourcetype="zeek:ssl:json" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[abnormally_high_number_of_cloud_infrastructure_api_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_security_group_api_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_create_policy_version_to_allow_all_resources_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -535,15 +547,11 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[aws_investigate_user_activities_by_arn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [aws_investigate_user_activities_by_accesskeyid_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. -[aws_network_acl_details_from_id_filter] +[aws_investigate_user_activities_by_arn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -555,6 +563,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_network_acl_details_from_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_network_interface_details_via_resourceid_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -579,26 +591,6 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[abnormally_high_number_of_cloud_infrastructure_api_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_instances_destroyed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_instances_launched_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_security_group_api_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[amazon_eks_kubernetes_activity_by_src_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [baseline_of_cloud_infrastructure_api_calls_per_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -671,15 +663,11 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[detect_new_open_s3_buckets_over_aws_cli_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [detect_new_open_s3_buckets_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. -[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] +[detect_new_open_s3_buckets_over_aws_cli_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -687,6 +675,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [get_all_aws_activity_from_city_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -711,11 +703,11 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[investigate_aws_user_activities_by_user_field_filter] +[investigate_aws_activities_via_region_name_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. -[investigate_aws_activities_via_region_name_filter] +[investigate_aws_user_activities_by_user_field_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -827,11 +819,19 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[previously_seen_users_in_cloudtrail___update_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [previously_seen_users_in_cloudtrail___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[previously_seen_users_in_cloudtrail___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 80ae9e8b43..0b5c608751 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,12 +1,90 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:45 UTC +# On Date: 2021-11-01T18:33:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# ### ESCU DETECTIONS ### +[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. +action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function. +action.escu.known_false_positives = +action.escu.creation_date = 2020-09-07 +action.escu.modification_date = 2020-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +action.risk = 1 +action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = false +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter` + +[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. +action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. +action.escu.known_false_positives = +action.escu.creation_date = 2020-09-07 +action.escu.modification_date = 2020-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +action.risk = 1 +action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = false +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter` + [ESCU - AWS Create Policy Version to allow all resources - Rule] action.escu = 0 action.escu.enabled = 1 @@ -709,162 +787,6 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter` -[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. -action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function. -action.escu.known_false_positives = -action.escu.creation_date = 2020-09-07 -action.escu.modification_date = 2020-09-07 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.risk = 1 -action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = false -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter` - -[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function. -action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. -action.escu.creation_date = 2020-08-21 -action.escu.modification_date = 2020-08-21 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] -action.risk = 1 -action.risk.param._risk_message = -action.risk.param._risk = [] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = false -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter` - -[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function. -action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. -action.escu.creation_date = 2020-08-21 -action.escu.modification_date = 2020-08-21 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] -action.risk = 1 -action.risk.param._risk_message = -action.risk.param._risk = [] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = false -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter` - -[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. -action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. -action.escu.known_false_positives = -action.escu.creation_date = 2020-09-07 -action.escu.modification_date = 2020-09-07 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.risk = 1 -action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = false -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter` - [ESCU - Cloud API Calls From Previously Unseen User Roles - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1415,45 +1337,6 @@ realtime_schedule = 0 is_visible = false search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter` -[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -action.escu.data_models = [] -action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -action.escu.how_to_implement = -action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-07-19 -action.escu.modification_date = 2021-07-19 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -action.risk = 1 -action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ -action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = false -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` - [ESCU - Detect New Open S3 buckets - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1493,33 +1376,33 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` -[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule] +[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} +description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -action.escu.known_false_positives = None -action.escu.creation_date = 2021-01-26 -action.escu.modification_date = 2021-01-26 +action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. +action.escu.how_to_implement = +action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high -action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule +action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Security Hub Alerts"] +action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ +action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} schedule_window = auto alert.digest_mode = 1 disabled = false @@ -1530,7 +1413,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter` +search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` [ESCU - Detect shared ec2 snapshot - Rule] action.escu = 0 @@ -1571,6 +1454,45 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` +[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals +action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} +action.escu.data_models = [] +action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. +action.escu.known_false_positives = None +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Security Hub Alerts"] +action.risk = 1 +action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = false +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter` + [ESCU - O365 Add App Role Assignment Grant User - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2000,6 +1922,84 @@ realtime_schedule = 0 is_visible = false search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter` +[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. +action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function. +action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. +action.escu.creation_date = 2020-08-21 +action.escu.modification_date = 2020-08-21 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] +action.risk = 1 +action.risk.param._risk_message = +action.risk.param._risk = [] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = false +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter` + +[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. +action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function. +action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. +action.escu.creation_date = 2020-08-21 +action.escu.modification_date = 2020-08-21 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] +action.risk = 1 +action.risk.param._risk_message = +action.risk.param._risk = [] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = false +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter` + ### END ESCU DETECTIONS ### @@ -2447,28 +2447,6 @@ disabled = false is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count -[ESCU - Previously Seen Users In CloudTrail - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update -description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -action.escu.creation_date = 2020-05-28 -action.escu.modification_date = 2020-05-28 -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -action.escu.data_models = ["Authentication"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -disabled = false -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins - [ESCU - Previously Seen Users in CloudTrail - Initial] action.escu = 0 action.escu.enabled = 1 @@ -2491,10 +2469,53 @@ disabled = false is_visible = false search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count +[ESCU - Previously Seen Users In CloudTrail - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update +description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +action.escu.creation_date = 2020-05-28 +action.escu.modification_date = 2020-05-28 +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +action.escu.data_models = ["Authentication"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +disabled = false +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins + ### ESCU RESPONSE TASKS ### +[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = investigative +action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task +description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address +action.escu.creation_date = 2020-04-13 +action.escu.modification_date = 2020-04-13 +action.escu.analytic_story = ["Kubernetes Scanning Activity"] +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +action.escu.providing_technologies = [] +action.escu.data_models = [] +action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address +action.escu.how_to_implement = none +action.escu.known_false_positives = None at this time +disabled = true +schedule_window = auto +is_visible = false +search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip + [ESCU - AWS Investigate Security Hub alerts by dest - Response Task] action.escu = 0 action.escu.enabled = 1 @@ -2516,27 +2537,6 @@ schedule_window = auto is_visible = false search = `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation -[ESCU - AWS Investigate User Activities By ARN - Response Task] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task -description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. -action.escu.creation_date = 2019-04-30 -action.escu.modification_date = 2019-04-30 -action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"] -action.escu.earliest_time_offset = 3600 -action.escu.latest_time_offset = 86400 -action.escu.providing_technologies = [] -action.escu.data_models = [] -action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. -action.escu.how_to_implement = none -action.escu.known_false_positives = None at this time -disabled = true -schedule_window = auto -is_visible = false -search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType - [ESCU - AWS Investigate User Activities By AccessKeyId - Response Task] action.escu = 0 action.escu.enabled = 1 @@ -2558,6 +2558,27 @@ schedule_window = auto is_visible = false search = `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage +[ESCU - AWS Investigate User Activities By ARN - Response Task] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = investigative +action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task +description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. +action.escu.creation_date = 2019-04-30 +action.escu.modification_date = 2019-04-30 +action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"] +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +action.escu.providing_technologies = [] +action.escu.data_models = [] +action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. +action.escu.how_to_implement = none +action.escu.known_false_positives = None at this time +disabled = true +schedule_window = auto +is_visible = false +search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + [ESCU - AWS Network ACL Details from ID - Response Task] action.escu = 0 action.escu.enabled = 1 @@ -2621,27 +2642,6 @@ schedule_window = auto is_visible = false search = `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList -[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task -description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address -action.escu.creation_date = 2020-04-13 -action.escu.modification_date = 2020-04-13 -action.escu.analytic_story = ["Kubernetes Scanning Activity"] -action.escu.earliest_time_offset = 3600 -action.escu.latest_time_offset = 86400 -action.escu.providing_technologies = [] -action.escu.data_models = [] -action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address -action.escu.how_to_implement = none -action.escu.known_false_positives = None at this time -disabled = true -schedule_window = auto -is_visible = false -search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip - [ESCU - Get All AWS Activity From City - Response Task] action.escu = 0 action.escu.enabled = 1 @@ -2768,27 +2768,6 @@ schedule_window = auto is_visible = false search = `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName -[ESCU - Investigate AWS User Activities by user field - Response Task] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task -description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. -action.escu.creation_date = 2018-03-12 -action.escu.modification_date = 2018-03-12 -action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"] -action.escu.earliest_time_offset = 3600 -action.escu.latest_time_offset = 86400 -action.escu.providing_technologies = [] -action.escu.data_models = [] -action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. -action.escu.how_to_implement = none -action.escu.known_false_positives = None at this time -disabled = true -schedule_window = auto -is_visible = false -search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType - [ESCU - Investigate AWS activities via region name - Response Task] action.escu = 0 action.escu.enabled = 1 @@ -2810,6 +2789,27 @@ schedule_window = auto is_visible = false search = `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region +[ESCU - Investigate AWS User Activities by user field - Response Task] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = investigative +action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task +description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. +action.escu.creation_date = 2018-03-12 +action.escu.modification_date = 2018-03-12 +action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"] +action.escu.earliest_time_offset = 3600 +action.escu.latest_time_offset = 86400 +action.escu.providing_technologies = [] +action.escu.data_models = [] +action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. +action.escu.how_to_implement = none +action.escu.known_false_positives = None at this time +disabled = true +schedule_window = auto +is_visible = false +search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + ### END ESCU RESPONSE TASKS ### \ No newline at end of file diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index fbf26057fa..7b44ffebb6 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-10-28T22:30:45 UTC +# On Date: 2021-11-01T18:33:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml index 87488976d4..59991812db 100644 --- a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml +++ b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml @@ -17,58 +17,17 @@ risk_message: Mimikatz malware is violating authentication processes by injectin golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1068 - - T1078 - - T1098 - - T1134 - - T1543 - - T1547 - - T1548 - - T1554 - - T1556 - - T1558 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true\ - \ OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line,\ - \ /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, + /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true + OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml index 413b8ec165..e6493fea5e 100644 --- a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml @@ -18,59 +18,20 @@ risk_message: PowerSploit malware is violating authentication by injecting stole credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1068 - - T1078 - - T1098 - - T1134 - - T1543 - - T1547 - - T1548 - - T1554 - - T1555 - - T1558 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line,\ - \ /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true )\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ - \ \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true + OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, + /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml index c01d8defe4..97c52f250d 100644 --- a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml +++ b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml @@ -14,52 +14,17 @@ references: - https://github.com/MichaelGrafnetter/DSInternals risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 16 - - CIS 20 - confidence: 85 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access - impact: 30 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - - T1087 - - T1201 - - T1552 - - T1555 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Test-PasswordQuality/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/attempt_to_delete_services.yml index 54233c7680..4e4711df40 100644 --- a/dist/ssa/detections/attempt_to_delete_services.yml +++ b/dist/ssa/detections/attempt_to_delete_services.yml @@ -17,32 +17,18 @@ product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -savedsearch_annotations: - analytic_story: - - XMRig - - Ransomware - cis20: - - CIS 8 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ - ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ - ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%delete%\") AND process_name\ - \ = \"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/attempt_to_disable_services.yml index f66428dfeb..4910940788 100644 --- a/dist/ssa/detections/attempt_to_disable_services.yml +++ b/dist/ssa/detections/attempt_to_disable_services.yml @@ -18,34 +18,19 @@ product: references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -savedsearch_annotations: - analytic_story: - - XMRig - - Ransomware - cis20: - - CIS 9 - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP -search: "\n| from read_ssa_enriched_events() \n| eval _datamodels=ucast(map_get(input_event,\ - \ \"_datamodels\"), \"collection\", []), body={} \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ - ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ - ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%disabled%\") AND like(cmd_line,\ - \ \"%config%\") AND process_name=\"sc.exe\" \n| eval start_time=timestamp, end_time=timestamp,\ - \ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ - \ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ - event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\ - parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, + "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") + AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 5eff79d0aa..0dad28f8eb 100644 --- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -15,53 +15,20 @@ references: risk_message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - DE.CM - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| eval process_name=lower(ucast(map_get(input_event,\ - \ \"process_name\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"\ - process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where process_name=\"cmd.exe\" OR process_name=\"reg.exe\" \n| where\ - \ cmd_line != null AND match_regex(cmd_line, /(?i)save\\s+/)=true AND ( match_regex(cmd_line,\ - \ /(?i)HKLM\\\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true\ - \ OR match_regex(cmd_line, /(?i)HKLM\\\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\ - \\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true\ - \ OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\System/)=true ) \n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),\ - \ body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ - , process_name]) \n| into write_ssa_detected_events(); " +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" + OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true + AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, + /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time + = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) + | into write_ssa_detected_events(); ' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml index eb5b8fc535..2737015eda 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml @@ -18,53 +18,22 @@ references: [] risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Unusual Processes - - Credential Dumping - cis20: - - CIS 16 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND process_name != null AND parent_process_name\ - \ != null AND match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true\ - \ AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\ - \ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-s/)=true\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name])\ - \ \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND parent_process_name != null + AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, + /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true + AND match_regex(cmd_line, /(?i)\-s/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml index 3b8c7ac1c0..5a22fae726 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml @@ -18,50 +18,20 @@ references: [] risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Unusual Processes - - Credential Dumping - cis20: - - CIS 16 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND process_name != null AND process_path !=\ - \ null AND match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND match_regex(process_path,\ - \ /(?i)\\\\Temp/)=true AND match_regex(cmd_line, /(?i)\\-v/)=true\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name]) \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, + /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true + AND match_regex(cmd_line, /(?i)\-v/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml index b885fd281a..ed25c18052 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml @@ -17,46 +17,17 @@ references: [] risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 16 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - - T1555 - nist: - - PR.IP - - PR.AC - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)all\\s+\\-oA\\\ - s+\\-output/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\ - \ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, + /(?i)all\s+\-oA\s+\-output/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml index 1389bb382b..7a8d5e84a8 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml @@ -18,55 +18,25 @@ references: risk_message: DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Malicious PowerShell - cis20: - - CIS 16 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ - , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true\ - \ OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,\ - \ /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true\ - \ OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,\ - \ /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true\ - \ OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,\ - \ /(?i)ConvertTo-UnicodePassword/)=true )\n\n| eval start_time = timestamp, end_time\ - \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ - , process_name]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, + "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true + OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, + /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true + OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, + /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true + OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, + /(?i)ConvertTo-UnicodePassword/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml index 639980240f..d02922041d 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml @@ -18,57 +18,27 @@ risk_message: DSInternals tool kit is accessing sensitive credential material su as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Malicious PowerShell - cis20: - - CIS 16 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ - , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line, \"process_name\", process_name]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, + "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true + OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, + /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true + OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, + /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true + OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true + OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true + OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, + /(?i)Get-SamPasswordPolicy/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml index a8a9c5bb55..4175d1eb9f 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml @@ -17,51 +17,22 @@ references: risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Unusual Processes - cis20: - - CIS 16 - confidence: 95 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true\ - \ OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true\ - \ OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true\ - \ OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line,\ - \ /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\ - \ match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true + OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true + OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true + OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true + OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml index 18b90a5d75..7d45538479 100644 --- a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml +++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml @@ -17,52 +17,23 @@ references: risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Malicious PowerShell - cis20: - - CIS 16 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true\ - \ OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true + OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true + OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, + /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true + OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, + /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml index 82a0286bde..d30e85ce9c 100644 --- a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml @@ -21,52 +21,21 @@ references: risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Unusual Processes - cis20: - - CIS 16 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.IP - - PR.AC - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND parent_process_name != null AND process_name\ - \ != null AND ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR match_regex(parent_process_name,\ - \ /(?i)livekd\\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\\.exe/)=true\ - \ AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\\\ - -ForceV1/)=true\n\n| eval start_time = timestamp, end_time = timestamp, entities\ - \ = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line, \"process_name\", process_name, \"parent_process_name\"\ - , parent_process_name]) \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line != null AND parent_process_name != null AND process_name + != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, + /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true + AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml index bc0f5ddf5d..1e950758a5 100644 --- a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml +++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml @@ -20,49 +20,19 @@ references: [] risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Unusual Processes - cis20: - - CIS 16 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND process_name != null AND ( match_regex(process_name,\ - \ /^(?i)ntkd\\.exe/)=true OR match_regex(process_name, /^(?i)kd\\.exe/)=true ) AND\ - \ match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n\n| eval start_time = timestamp, end_time\ - \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ - , process_name]) \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name, + /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, + /(?i)\-z\s+/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml index c357c97f08..cd54f57691 100644 --- a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml +++ b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml @@ -18,47 +18,17 @@ references: [] risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - - Malicious PowerShell - cis20: - - CIS 16 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003 - nist: - - PR.IP - - PR.AC - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true\ - \ AND match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\\n|]+/)=true\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ - \ \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, + /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/delete_a_net_user.yml index d0e32cc584..e38926b2ee 100644 --- a/dist/ssa/detections/delete_a_net_user.yml +++ b/dist/ssa/detections/delete_a_net_user.yml @@ -20,33 +20,18 @@ product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -savedsearch_annotations: - analytic_story: - - XMRig - - Ransomware - cis20: - - CIS 4 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.AC - - PR.IP -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ - ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ - ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/delete%\") AND (process_name=\"\ - net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp, end_time=timestamp,\ - \ entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ - \ ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ - event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name, \"\ - parent_process_name\", parent_process_name, \"process_path\", process_path]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/deny_permission_using_cacls_utility.yml index e4f680dc49..8db36bc4e7 100644 --- a/dist/ssa/detections/deny_permission_using_cacls_utility.yml +++ b/dist/ssa/detections/deny_permission_using_cacls_utility.yml @@ -20,46 +20,18 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - XMRig - cis20: - - CIS 14 - - CIS 16 - confidence: 70 - context: - - source:endpoint - - stage: Defense Evasion - impact: 50 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true\ - \ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\ - icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml index e7291f5901..b1c7914dfb 100644 --- a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml +++ b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml @@ -17,48 +17,15 @@ references: risk_message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 8 - - CIS 16 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1003.003 - - T1003 - nist: - - DE.CM - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events() \n| eval tenant=ucast(map_get(input_event,\ - \ \"_tenant\"), \"string\", null), machine=ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\ - ), \"string\", null)), process=lower(ucast(map_get(input_event, \"process\"), \"\ - string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where process_name LIKE \"%rundll32.exe%\" AND match_regex(process,\ - \ /(?i)comsvcs.dll[,\\s]+MiniDump/)=true \n| eval start_time = timestamp, end_time\ - \ = timestamp, entities = mvappend(machine), body=create_map([\"event_id\", event_id,\ - \ \"process_name\", process_name, \"process\", process]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, + "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), + "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, + /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = + timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, + "process_name", process_name, "process", process]) | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/detect_kerberoasting.yml index 1db7da3626..b13d0b9267 100644 --- a/dist/ssa/detections/detect_kerberoasting.yml +++ b/dist/ssa/detections/detect_kerberoasting.yml @@ -16,53 +16,21 @@ references: risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Credential Dumping - cis20: - - CIS 8 - - CIS 16 - confidence: 20 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1558.003 - - T1558 - nist: - - DE.CM - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events() \n| eval _time=map_get(input_event,\ - \ \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event,\ - \ \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"\ - ), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event,\ - \ \"service_id\"), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"\ - string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"),\ - \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"\ - 0x17\" \n| first_time_event input_columns=[\"EventCode\",\"TicketOptions\",\"TicketEncryptionType\"\ - ,\"ServiceName\",\"ServiceID\"] \n| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\ - \ \n| eval start_time=_time, end_time=_time, body=create_map([\"event_id\", event_id,\ - \ \"EventCode\", EventCode, \"ServiceName\", ServiceName, \"TicketOptions\", TicketOptions,\ - \ \"TicketEncryptionType\", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null))\n| select start_time, end_time, entities, body \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), + EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, + "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), + ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, + "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" + AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event + input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] + | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID + | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, + "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, + "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();' tags: analytic_story: - Credential Dumping diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/detect_pass_the_hash.yml index ab5fdfc434..9f263ff519 100644 --- a/dist/ssa/detections/detect_pass_the_hash.yml +++ b/dist/ssa/detections/detect_pass_the_hash.yml @@ -16,54 +16,21 @@ references: risk_message: Potential use of the pass the hash/token attacks that spoof authentication. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Lateral Movement - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 20 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| eval signature_id=map_get(input_event, \"signature_id\"\ - ), authentication_type=map_get(input_event, \"authentication_type\"), authentication_method=map_get(input_event,\ - \ \"authentication_method\"), origin_device_domain=map_get(input_event, \"origin_device_domain\"\ - ), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\ - \ dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\ - \ event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null)\n\n| where\ - \ (authentication_type=\"3\" AND authentication_method=\"NtLmSsp\") OR (authentication_type=\"\ - 9\" AND authentication_method=\"seclogo\")\n\n| eval start_time=timestamp, end_time=timestamp,\ - \ entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"event_id\"\ - , event_id, \"authentication_type\", authentication_type, \"authentication_method\"\ - , authentication_method]) \n| into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event, + "authentication_type"), authentication_method=map_get(input_event, "authentication_method"), + origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9" + AND authentication_method="seclogo") + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, + "authentication_method", authentication_method]) | into write_ssa_detected_events();' tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml index d83661a6e9..3f956fddcf 100644 --- a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml @@ -18,56 +18,24 @@ references: [] risk_message: Potential malicious landing to the console via unexpected programs that called cmd.exe. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. -savedsearch_annotations: - analytic_story: - - Suspicious Command-Line Executions - - Suspicious MSHTA Activity - - Suspicious Zoom Child Processes - - Sunburst Malware - cis20: - - CIS 8 - confidence: 80 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 70 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1059 - nist: - - PR.PT - - DE.CM - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| eval process_name=ucast(map_get(input_event,\ - \ \"process_name\"), \"string\", null), parent_process=lower(ucast(map_get(input_event,\ - \ \"parent_process_name\"), \"string\", null)), dest_user_id=ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null), event_id=ucast(map_get(input_event, \"\ - event_id\"), \"string\", null)\n\n| where process_name=\"cmd.exe\" \n| rex field=parent_process\ - \ \"(?[^\\\\\\\\]+)$\" \n| where field0=\"winword.exe\" OR field0=\"excel.exe\"\ - \ OR field0=\"outlook.exe\" OR field0=\"powerpnt.exe\" OR field0=\"visio.exe\" OR\ - \ field0=\"mspub.exe\" OR field0=\"acrobat.exe\" OR field0=\"acrord32.exe\" OR field0=\"\ - chrome.exe\" OR field0=\"iexplore.exe\" OR field0=\"opera.exe\" OR field0=\"firefox.exe\"\ - \ OR field0=\"java.exe\" OR field0=\"powershell.exe\"\n\n| eval start_time=timestamp,\ - \ end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map([\"\ - event_id\", event_id, \"process_name\", process_name, \"parent_process_name\",\ - \ parent_process]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), + parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", + null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) + + | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" + | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" + OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" + OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" + OR field0="java.exe" OR field0="powershell.exe" + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, + "parent_process_name", parent_process]) | into write_ssa_detected_events();' tags: analytic_story: - Suspicious Command-Line Executions diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/disable_net_user_account.yml index 81aba69c14..6bdecec8ff 100644 --- a/dist/ssa/detections/disable_net_user_account.yml +++ b/dist/ssa/detections/disable_net_user_account.yml @@ -19,33 +19,18 @@ product: - Splunk Behavioral Analytics references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -savedsearch_annotations: - analytic_story: - - XMRig - - Ransomware - cis20: - - CIS 4 - - CIS 16 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.AC - - PR.IP -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ - ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ - ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/active:no%\") AND\ - \ (process_name=\"net1.exe\" OR process_name=\"net.exe\") \n| eval start_time=timestamp,\ - \ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ - , process_name, \"parent_process_name\", parent_process_name, \"process_path\",\ - \ process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/first_time_seen_command_line_argument.yml index 06db177fa6..31cac23810 100644 --- a/dist/ssa/detections/first_time_seen_command_line_argument.yml +++ b/dist/ssa/detections/first_time_seen_command_line_argument.yml @@ -17,57 +17,23 @@ product: references: [] risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Unusual Processes - cis20: - - CIS 3 - - CIS 8 - confidence: 60 - context: - - source:endpoint - - stage: Defense Evasion - impact: 50 - kill_chain_phases: - - Command and Control - - Actions on Objectives - mitre_attack: - - T1059 - - T1117 - - T1202 - nist: - - PR.PT - - DE.CM - - PR.IP - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| eval dest_user_id=ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), dest_device_id=ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null), process_name=ucast(map_get(input_event,\ - \ \"process_name\"), \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), cmd_line_norm=lower(cmd_line), cmd_line_norm=replace(cmd_line_norm,\ - \ /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, \"\ - GUID\"), cmd_line_norm=replace(cmd_line_norm, /(?<=\\s)+\\\\[^:]*(?=\\\\.*\\.\\\ - w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \" \\\\Something\\\\Something\\\\command.ext\"\ - \ => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm, /\\w:\\\\[^:]*(?=\\\ - \\.*\\.\\w{3}(\\s\n|$)+)/, \"\\\\PATH\"), /* replaces \"C:\\\\Something\\\\Something\\\ - \\command.ext\" => \"PATH\\\\command.ext\" */ cmd_line_norm=replace(cmd_line_norm,\ - \ /\\d+/, \"N\"), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where process_name=\"cmd.exe\" AND match_regex(ucast(cmd_line, \"string\"\ - , \"\"), /.* \\/[cC] .*/)=true \n| select process_name, cmd_line, cmd_line_norm,\ - \ timestamp, dest_device_id, dest_user_id \n| first_time_event input_columns=[\"\ - cmd_line_norm\"] \n| where first_time_cmd_line_norm \n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\ - event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), + "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), + cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, + "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, + "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" + */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), + /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, + /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) | + where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* + \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, + dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm + | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/grant_permission_using_cacls_utility.yml index 4aa278c41b..72d50af052 100644 --- a/dist/ssa/detections/grant_permission_using_cacls_utility.yml +++ b/dist/ssa/detections/grant_permission_using_cacls_utility.yml @@ -20,46 +20,18 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - XMRig - cis20: - - CIS 14 - - CIS 16 - confidence: 70 - context: - - source:endpoint - - stage: Defense Evasion - impact: 50 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true\ - \ AND (process_name=\"cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"\ - icacls.exe\") \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml index 1d178e6b0e..83a0227bb6 100644 --- a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml @@ -16,54 +16,20 @@ references: risk_message: PowerSploit malware is tapping into user content - microphone, camera, ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Malicious PowerShell - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Exfiltration - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 85 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1113 - - T1123 - - T1563 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR + match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true + OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, + /(?i)Get-WebConfig/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Malicious PowerShell diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml index 07b31c86e2..15a2017e7f 100644 --- a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml @@ -15,47 +15,17 @@ references: risk_message: PowerSploit malware is creating illegal domain accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Persistence - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1585 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)New-DomainUser/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml index a9603449f8..8dcad8203f 100644 --- a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml @@ -15,48 +15,17 @@ references: risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Log Manipulation - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 50 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1070 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true\ - \ OR match_regex(cmd_line, /(?i)event::clear/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ - \ into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Log Manipulation diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml index 2efd3130f9..30f260db39 100644 --- a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml +++ b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml @@ -15,49 +15,18 @@ references: risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true\ - \ OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true )\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ - \ \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml index 37d5050d0d..4f1020f197 100644 --- a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml +++ b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml @@ -16,51 +16,19 @@ references: risk_message: DSInternals malware is controlling infrastructure by modifying Active Directory elements, domain controllers, and policies. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1207 - - T1484 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true\ - \ OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line,\ - \ /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true + OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, + /(?i)Set-LsaPolicyInformation/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml index ecba1f0562..00a926ceea 100644 --- a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml @@ -16,51 +16,20 @@ references: risk_message: PowerSploit malware is controlling infrastructure by modifying Active Directory elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1207 - - T1484 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true\ - \ OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true\ - \ OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )\n\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ - \ \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR + match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, + /(?i)Set-MasterBootRecord/)=true ) + + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index fd38b58f4c..1fa9004a72 100644 --- a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -16,55 +16,19 @@ references: risk_message: PowerSploit malware is planting attack persistence elements, altering privileges and access controls. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Malicious PowerShell - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Privilege Escalation - - Stage:Command And Control - - Stage:Persistence - - Consequence:Loss Of Control - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1053 - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true\ - \ OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true\ - \ OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,\ - \ /(?i)New-UserPersistenceOption/)=true )\n\n| eval start_time = timestamp, end_time\ - \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ - \ into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true + OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true + OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Malicious PowerShell diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml index 1292ab88eb..4983ffeeb3 100644 --- a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml @@ -15,50 +15,18 @@ references: risk_message: Mimikatz malware is setting highest privileges to malicious entities. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Privilege Escalation - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Privilege Escalation - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true\ - \ OR match_regex(cmd_line, /(?i)token::elevate/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ - \ into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Privilege Escalation diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml index 77f4173183..7a9d428326 100644 --- a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml @@ -15,53 +15,20 @@ references: risk_message: Mimikatz malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Service Abuse - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1106 - - T1569 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true\ - \ OR match_regex(cmd_line, /(?i)service::\\+/)=true OR match_regex(cmd_line, /(?i)service::\\\ - -/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,\ - \ /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true\ - \ OR match_regex(cmd_line, /(?i)misc::memssp/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n|\ - \ into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, + /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, + /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true + OR match_regex(cmd_line, /(?i)misc::memssp/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Service Abuse diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml index a66a0928bb..e45c13be43 100644 --- a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml +++ b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml @@ -17,59 +17,27 @@ references: risk_message: PowerSploit malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Service Abuse - - Malicious PowerShell - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1055 - - T1106 - - T1569 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true\ - \ OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line,\ - \ /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true\ - \ OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line,\ - \ /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line,\ - \ /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line,\ - \ /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true\ - \ OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true )\n\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ - \ \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true + OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, + /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true + OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, + /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true + OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, + /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true + OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, + /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true + ) + + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Service Abuse diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml index 611f9ca6af..a1fefe4fba 100644 --- a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml @@ -22,41 +22,19 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - XMRig - confidence: 70 - context: - - source:endpoint - - stage: Defense Evasion - impact: 50 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1222 - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%/G%\") AND (match_regex(cmd_line,\ - \ /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name=\"\ - cacls.exe\" OR process_name=\"xcacls.exe\" OR process_name=\"icacls.exe\") \n| eval\ - \ start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, + /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" + OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' tags: analytic_story: - XMRig diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml index 979043c45f..b0ce976cf1 100644 --- a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml +++ b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml @@ -18,72 +18,40 @@ references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Unusual Processes - cis20: - - CIS 8 - confidence: 50 - context: - - source:endpoint - - stage: Defense Evasion - impact: 50 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1059 - - T1053 - nist: - - PR.PT - - DE.CM - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: process_name - role: - - Others - type: processname -search: " \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null), process_name=lower(ucast(map_get(input_event,\ - \ \"process_name\"), \"string\", null)), timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| where process_name==\"regsvcs.exe\" OR process_name==\"\ - ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"\ - schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\"\ - \ OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"\ - reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"\ - print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"\ - rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR\ - \ process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"\ - mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\"\ - \ OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"\ - microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"\ - makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\"\ - \ OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"\ - register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"\ - ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"\ - hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"\ - jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\"\ - \ OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"\ - diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\"\ - \ OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"\ - gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\"\ - \ OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"\ - gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"\ - regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"\ - syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"\ - psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\"\ - \ OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"\ - netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"\ - at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"\ - msconfig.exe\" \n| stats count(process_name) as lolbas_counter by device,span(timestamp,\ - \ 300s) \n| eval lolbas_counter=lolbas_counter*1.0 \n| rename window_end as timestamp\ - \ \n| adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"\ - device\" window=2419200000L \n| where label AND quantile>0.99 \n| eval start_time\ - \ = window_start, end_time = timestamp, entities = mvappend(device), body=create_map([\"\ - lolbas_counter\", lolbas_counter, \"quantile\", quantile, \"device\", device]) \n\ - | into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" + OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" + OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" + OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" + OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" + OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" + OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" + OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" + OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" + OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" + OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" + OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" + OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" + OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" + OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" + OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" + OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" + OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" + OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" + OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" + OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR + process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" + OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" + OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" + OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" + OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by + device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end + as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" + window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, + end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", + lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml index f39d42227a..c1f2707376 100644 --- a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml +++ b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml @@ -24,41 +24,26 @@ name: Phishing Email Detection by Machine Learning Method - SSA product: - Splunk Behavioral Analytics references: [] -savedsearch_annotations: - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1566 - nist: - - PR.PT - - DE.CM -search: "\n| from read_ssa_enriched_events() \n| eval eventLine=concat(ucast(map_get(input_event,\ - \ \"From\"), \"string\", \" \"), \" \", ucast(map_get(input_event, \"Subject\"),\ - \ \"string\", \" \"), \" \", ucast(map_get(input_event, \"Content\"), \"string\"\ - , \" \"), \" \ - \ \"), _time=map_get(input_event,\ - \ \"_time\") \n| where eventLine IS NOT NULL \n| eval mapC={\" \": 32, \"!\": 33,\ - \ \"\\\"\": 34, \"#\": 35, \"$\": 36, \"%\": 37, \"&\": 38, \"`\": 39, \"(\": 40,\ - \ \")\": 41, \"*\": 42, \"+\": 43, \",\": 44, \"-\": 45, \".\": 46, \"/\": 47, \"\ - 0\": 48, \"1\": 49, \"2\": 50, \"3\": 51, \"4\": 52, \"5\": 53, \"6\": 54, \"7\"\ - : 55, \"8\": 56, \"9\": 57, \":\": 58, \";\": 59, \"<\": 60, \"=\": 61, \">\": 62,\ - \ \"?\": 63, \"@\": 64, \"A\": 65, \"B\": 66, \"C\": 67, \"D\": 68, \"E\": 69, \"\ - F\": 70, \"G\": 71, \"H\": 72, \"I\": 73, \"J\": 74, \"K\": 75, \"L\": 76, \"M\"\ - : 77, \"N\": 78, \"O\": 79, \"P\": 80, \"Q\": 81, \"R\": 82, \"S\": 83, \"T\": 84,\ - \ \"U\": 85, \"V\": 86, \"W\": 87, \"X\": 88, \"Y\": 89, \"Z\": 90, \"[\": 91, \"\ - \\\\\": 92, \"]\": 93, \"^\": 94, \"_\": 95, \"`\": 96, \"a\": 97, \"b\": 98, \"\ - c\": 99, \"d\": 100, \"e\": 101, \"f\": 102, \"g\": 103, \"h\": 104, \"i\": 105,\ - \ \"j\": 106, \"k\": 107, \"l\": 108, \"m\": 109, \"n\": 110, \"o\": 111, \"p\"\ - : 112, \"q\": 113, \"r\": 114, \"s\": 115, \"t\": 116, \"u\": 117, \"v\": 118, \"\ - w\": 119, \"x\": 120, \"y\": 121, \"z\": 122, \"{\": 123, \"\n|\": 124, \"}\": 125,\ - \ \"~\": 126}, ml_in = for_each(iterator(mvrange(1,129), \"i\"), cast(map_get(mapC,\ - \ substr(eventLine, i, 1)), \"float\") ) \n| apply_model connection_id=\"YOUR_S3_ONNX_CONNECTOR_ID\"\ - \ name=\"phishing_email_v8\" path=\"s3://smle-experiments/models/phishing_email\"\ - \ \n| eval probability = mvindex(ml_out, 0) \n| where probability > 0.5 \n| eval\ - \ start_time=_time, end_time=_time, entities=\"TBD\", body=\"TBD\" \n| select probability,\ - \ body, entities, start_time, end_time \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event, + "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " + "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), + _time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={" + ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, + ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, + "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, + ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, + "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, + "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, + "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, + "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": + 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": + 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": + 119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in + = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, + 1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8" + path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out, + 0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD", + body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();' tags: cis20: - CIS 8 diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml index c5908a22a5..152216867c 100644 --- a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -18,59 +18,34 @@ references: risk_message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Lateral Movement - cis20: - - CIS 16 - - CIS 20 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - - Stage:Lateral Movement - impact: 80 - kill_chain_phases: - - Lateral Movement - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Other - type: Hostname -search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\ - \ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null)), dest_device_id= lower(ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\ - \ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\ - \ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\ - \ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\ - \ AND dest_user_id != null AND dest_device_id != null\n\n| eval isKerberos=if(authentication_method\ - \ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\ - \ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\ - \ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\ - \ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\ - \ dest_user, dest_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\ - -\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\ - \ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\ - \ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=ucast(startNTLMTime,\ - \ \"long\", null), end_time=ucast(endNTLMTime, \"long\", null), entities=mvappend(dest_user_id,\ - \ dest_device_id), body=create_map([\"total_kerberos\", totalKerberos, \"total_ntlm\"\ - , totalNtlm, \"analysis_start_time\", startTime, \"analysis_end_time\", endTime,\ - \ \"pth_start_time\", startNTLMTime, \"pth_end_time\", endNTLMTime])\n\n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, + "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), + "string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), + "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), + "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)) + + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND dest_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, + "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos", + totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", + endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime]) + + | into write_ssa_detected_events();' tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml index 2c2f92b9e0..e35cde279a 100644 --- a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -20,59 +20,34 @@ references: risk_message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ -savedsearch_annotations: - analytic_story: - - Lateral Movement - cis20: - - CIS 16 - - CIS 20 - confidence: 80 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - - Stage:Lateral Movement - impact: 80 - kill_chain_phases: - - Lateral Movement - mitre_attack: - - T1550 - - T1550.002 - nist: - - PR.PT - - PR.AT - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: origin_device_id - role: - - Other - type: Hostname -search: "\n| from read_ssa_enriched_events() \n| eval timestamp= parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), dest_user= lower(ucast(map_get(input_event,\ - \ \"dest_user_primary_artifact\"), \"string\", null)), dest_user_id= lower(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null)), origin_device_id= lower(ucast(map_get(input_event,\ - \ \"origin_device_id\"), \"string\", null)), signature_id= lower(ucast(map_get(input_event,\ - \ \"signature_id\"), \"string\", null)), authentication_method= lower(ucast(map_get(input_event,\ - \ \"authentication_method\"), \"string\", null))\n\n| where signature_id = \"4624\"\ - \ AND (authentication_method=\"ntlmssp\" OR authentication_method=\"kerberos\")\ - \ AND dest_user_id != null AND origin_device_id != null\n\n| eval isKerberos=if(authentication_method\ - \ == \"kerberos\", 1, 0), isNtlm=if(authentication_method == \"ntlmssp\", 1, 0),\ - \ timeNTLM=if(isNtlm > 0, timestamp, null)\n\n| stats sum(isKerberos) as totalKerberos,\ - \ sum(isNtlm) as totalNtlm, min(timestamp) as startTime, min(timeNTLM) as\ - \ startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as endNTLMTime by dest_user_id,\ - \ dest_user, origin_device_id, span(timestamp, 86400s)\n\n| where NOT dest_user=\"\ - -\" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND\ - \ (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime)\ - \ > 3 * (endNTLMTime - startNTLMTime)\n\n| eval start_time=startNTLMTime, end_time=endNTLMTime,\ - \ entities=mvappend(dest_user_id, origin_device_id), body=create_map([\"total_kerberos\"\ - , totalKerberos, \"total_ntlm\", totalNtlm, \"analysis_start_time\", startTime,\ - \ \"analysis_end_time\", endTime, \"detection_start_time\", startNTLMTime, \"detection_end_time\"\ - , endNTLMTime])\n\n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, + "_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), + "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), + "string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"), + "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)) + + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND origin_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, + origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm", + totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time", + startNTLMTime, "detection_end_time", endNTLMTime]) + + | into write_ssa_detected_events();' tags: analytic_story: - Lateral Movement diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml index 83a838da56..0ca07c65e5 100644 --- a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -15,50 +15,18 @@ references: risk_message: PowerSploit malware is probing access with stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Privilege Escalation - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access - impact: 60 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line,\ - \ /(?i)Test-ServiceDaclPermission/)=true )\n\n| eval start_time = timestamp, end_time\ - \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true + OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Privilege Escalation diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/rare_parent-child_process_relationship.yml index 4cc2eaa5e4..89c0d48501 100644 --- a/dist/ssa/detections/rare_parent-child_process_relationship.yml +++ b/dist/ssa/detections/rare_parent-child_process_relationship.yml @@ -16,67 +16,47 @@ name: Rare Parent-Child Process Relationship product: - Splunk Behavioral Analytics references: [] -savedsearch_annotations: - analytic_story: - - Unusual Processes - cis20: - - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1203 - - T1059 - - T1053 - - T1072 - nist: - - PR.PT - - DE.CM -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| eval parent_process=lower(ucast(map_get(input_event,\ - \ \"parent_process_name\"), \"string\", null)), parent_process_name=mvindex(split(parent_process,\ - \ \"\\\\\"), -1), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ - , null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\",\ - \ null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\", null) \n\ - | where parent_process_name!=null \n| select parent_process_name, process_name,\ - \ cmd_line, timestamp, dest_device_id, dest_user_id \n| conditional_anomaly conditional=\"\ - parent_process_name\" target=\"process_name\" \n| where (process_name=\"powershell.exe\"\ - \ OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"\ - dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR\ - \ process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"\ - esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"\ - csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"\ - pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"\ - wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR\ - \ process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"\ - bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR\ - \ process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR\ - \ process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"\ - forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\"\ - \ OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR\ - \ process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"\ - sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"\ - cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"\ - scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\"\ - \ OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"\ - extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\"\ - \ OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"\ - rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\"\ - \ OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR\ - \ process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"\ - wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\"\ - \ OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"\ - infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\"\ - \ OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"\ - wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"\ - pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\") \n\ - | eval input = (-1)*log(output) \n| adaptive_threshold algorithm=\"gaussian\" threshold=0.001\ - \ window=604800000L \n| where label AND input > mean \n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body\ - \ = create_map([\"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"input\", input, \"mean\", mean, \"variance\", variance, \"output\", output,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, + "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, + "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, + timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" + target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" + OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" + OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" + OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" + OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" + OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" + OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" + OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" + OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" + OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" + OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" + OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" + OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" + OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" + OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" + OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" + OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" + OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" + OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" + OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" + OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" + OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR + process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" + OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" + OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" + OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") + | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 + window=604800000L | where label AND input > mean | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = + create_map(["process_name", process_name, "parent_process_name", parent_process_name, + "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", + cmd_line]) | into write_ssa_detected_events();' tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml index a0cd27b5dc..31f619c600 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml @@ -15,51 +15,17 @@ references: risk_message: Mimikatz malware is searching for and using specific accounts and groups. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true\ - \ OR match_regex(cmd_line, /(?i)net::group/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml index ee09af5fc7..92228f1f00 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml @@ -16,72 +16,39 @@ risk_message: PowerSploit malware is searching for and using specific accounts, and policies, such as the last logged on account, a local Net group, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line,\ - \ /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true\ - \ OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line,\ - \ /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true\ - \ OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR\ - \ match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,\ - \ /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-LastLoggedOn/)=true )\n\n| eval start_time = timestamp, end_time = timestamp,\ - \ entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\"\ - , null), ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)), body=create_map([\"\ - event_id\", event_id, \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true + OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, + /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true + OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, + /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true + OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, + /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true + OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true + OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, + /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true + OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, + /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true + OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true + OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, + /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true + OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true + OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true + OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, + /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true + OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, + /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true + OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, + /(?i)Get-LastLoggedOn/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml index fe51886cbe..94b71630bf 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml @@ -17,62 +17,26 @@ references: risk_message: PowerSploit malware is seaching for or accessing Active Directory objects such as domain sites, domain trusts, AD forests, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1199 - - T1482 - - T1590 - - T1591 - - T1595 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR + match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true + OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true + OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, + /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true + OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true + OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true + OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, + /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true + OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml index e019910150..7d9bc758d1 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml @@ -15,55 +15,22 @@ references: risk_message: PowerSploit malware is seaching for or accessing domain controllers, computers, file servers, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592 - - T1590 - - T1087 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR + match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true + OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true + OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, + /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml index 2de8b461e3..e535127dfe 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml @@ -15,46 +15,17 @@ references: risk_message: Mimikatz malware is collecting information about computers. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - impact: 50 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)net::ServerInfo/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml index b6ecc600ca..c6e15a4764 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml @@ -16,63 +16,23 @@ references: risk_message: PowerSploit malware is searching for and tapping into ongoing processes, mounted drives or other operating system elements. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1057 - - T1083 - - T1592.002 - - T1046 - - T1012 - - T1007 - - T1047 - - T1592 - - T1518 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true\ - \ OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-RegistryMountedDrive/)=true )\n\n| eval start_time = timestamp, end_time\ - \ = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true + OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, + /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR + match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true + OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true + OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, + /(?i)Get-RegistryMountedDrive/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml index f13647e4fb..1386b1bcd0 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml @@ -14,49 +14,17 @@ references: - https://github.com/gentilkiwi/mimikatz risk_message: Mimikatz malware is listing processes and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - impact: 50 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1007 - - T1046 - - T1057 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true\ - \ OR match_regex(cmd_line, /(?i)service::list/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml index e59fd16b33..b844115ffb 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml @@ -15,51 +15,17 @@ references: risk_message: Mimikatz malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Lateral Movement - - Stage:Collection - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)net::share/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml index f72b3cbcf8..a5717e2d6b 100644 --- a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml @@ -15,56 +15,21 @@ references: risk_message: PowerSploit malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Lateral Movement - - Stage:Collection - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true\ - \ OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line,\ - \ /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true\ - \ OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true + OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, + /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true + OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, + /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml index b10528e22f..180502299c 100644 --- a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -19,61 +19,27 @@ risk_message: PowerSploit malware is searching for an entry point into the infra such as local admin accounts, opportunities to hijack processes, unattended install files, or modifiable access objects. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - impact: 60 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1053 - - T1068 - - T1078 - - T1543 - - T1547 - - T1574 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true\ - \ OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line,\ - \ /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true\ - \ OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true )\n\n| eval start_time\ - \ = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line])\ - \ \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true + OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, + /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true + OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, + /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true + OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, + /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true + OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, + /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true + OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, + /(?i)Get-UnquotedService/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml index c448efee2b..17fa0d433f 100644 --- a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml @@ -16,54 +16,23 @@ risk_message: PowerSploit malware is performing port scans or searching for vari connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1021 - - T1039 - - T1135 - - T1021.002 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,\ - \ /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true\ - \ OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true + OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, + /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true + OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, + /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true + OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true + ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml index 5b6ec5f7ea..917c3e96a1 100644 --- a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml @@ -15,56 +15,19 @@ references: risk_message: Mimikatz malware is searching for and accessing credential stores. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1098 - - T1590.001 - - T1078 - - T1589.001 - - T1590 - - T1068 - - T1589 - - T1590.003 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true\ - \ OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true\ - \ OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, + /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true + OR match_regex(cmd_line, /(?i)crypto::sc/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml index 9193687816..003200c4f9 100644 --- a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml @@ -15,49 +15,17 @@ references: risk_message: PowerSploit malware is looking for presence of anti virus software. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - impact: 40 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1592.002 - - T1595.002 - - T1592 - - T1595 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Find-AVSignature/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml index fc3e4e0788..b18fdedae6 100644 --- a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -15,48 +15,17 @@ references: risk_message: PowerSploit malware is engaging its privilege escalation module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - impact: 60 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Invoke-PrivescAudit/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml index 2d3cbadadf..01f877fb49 100644 --- a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml +++ b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml @@ -20,50 +20,17 @@ references: risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Discovery Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1543 - - T1055 - - T1574 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)misc::detours/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Discovery Techniques diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/resize_shadowstorage_volume.yml index b7a6a1f554..b173fa9bd4 100644 --- a/dist/ssa/detections/resize_shadowstorage_volume.yml +++ b/dist/ssa/detections/resize_shadowstorage_volume.yml @@ -20,33 +20,19 @@ product: references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -savedsearch_annotations: - analytic_story: - - Clop Ransomware - - Ransomware - cis20: - - CIS 10 - - CIS 13 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1489 - nist: - - PR.DS - - PR.IP -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ - ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ - ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"%resize%\") AND like(cmd_line,\ - \ \"%shadowstorage%\") AND like(cmd_line, \"%maxsize%\") AND process_name=\"vssadmin.exe\"\ - \ \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") + AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' tags: analytic_story: - Clop Ransomware diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml index c8cfc0871e..6f6a99b98e 100644 --- a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml @@ -15,57 +15,23 @@ references: risk_message: DSInternals malware is accessing, using or setting Active Directory or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Source:Cloud Data - - Stage:Credential Access - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), process_name=ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), cmd_line=ucast(map_get(input_event, \"process\"), \"string\"\ - , null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true\ - \ OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line,\ - \ /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true\ - \ OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line,\ - \ /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, + "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true + OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true + OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, + /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true + OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml index 8f8f8ee2b2..69e8975d54 100644 --- a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml @@ -15,50 +15,17 @@ references: risk_message: Mimikatz malware is accessing, using or setting account credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - - Consequence:Loss Of Control - impact: 80 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true\ - \ OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )\n\n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line]) \n\ - | into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml index 4cf8dda9da..b7be76f7d7 100644 --- a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml +++ b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml @@ -15,49 +15,17 @@ references: risk_message: PowerSploit malware is setting passwords on Active Directory accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ -savedsearch_annotations: - analytic_story: - - Windows Persistence Techniques - cis20: - - CIS 16 - - CIS 20 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - - Consequence:Loss Of Control - impact: 90 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - observable: - - name: dest_user_id - role: - - Actor - type: User - - name: dest_device_id - role: - - Victim - type: Hostname - - name: cmd_line - role: - - Others - type: processname -search: "\n| from read_ssa_enriched_events()\n\n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true\ - \ )\n\n| eval start_time = timestamp, end_time = timestamp, entities = mvappend(\ - \ ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null)), body=create_map([\"event_id\", event_id,\ - \ \"cmd_line\", cmd_line]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, + /(?i)Set-DomainUserPassword/)=true ) + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Persistence Techniques diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/system_process_running_from_unexpected_location.yml index 66246da68e..e2f559c1c3 100644 --- a/dist/ssa/detections/system_process_running_from_unexpected_location.yml +++ b/dist/ssa/detections/system_process_running_from_unexpected_location.yml @@ -16,276 +16,223 @@ product: references: [] risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Windows Defense Evasion Tactics - - Masquerading - Rename System Utilities - cis20: - - CIS 8 - confidence: 80 - context: - - source:endpoint - - stage: Defense Evasion - impact: 70 - kill_chain_phases: - - Actions on Objectives - mitre_attack: - - T1036 - nist: - - PR.PT - - DE.CM - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: " $ssa_input = \n| from read_ssa_enriched_events() \n| eval device=ucast(map_get(input_event,\ - \ \"dest_device_id\"), \"string\", null), user=ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), timestamp=parse_long(ucast(map_get(input_event, \"_time\"\ - ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ - ), \"string\", null)), process_path=lower(ucast(map_get(input_event, \"process_path\"\ - ), \"string\", null)), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null);\n$cond_1 = \n| from $ssa_input \n| where process_name=\"arp.exe\" OR process_name=\"\ - adaptertroubleshooter.exe\" OR process_name=\"applicationframehost.exe\" OR process_name=\"\ - atbroker.exe\" OR process_name=\"authhost.exe\" OR process_name=\"autoworkplace.exe\"\ - \ OR process_name=\"axinstui.exe\" OR process_name=\"backgroundtransferhost.exe\"\ - \ OR process_name=\"bdehdcfg.exe\" OR process_name=\"bdeuisrv.exe\" OR process_name=\"\ - bdeunlockwizard.exe\" OR process_name=\"bitlockerdeviceencryption.exe\" OR process_name=\"\ - bitlockerwizard.exe\" OR process_name=\"bitlockerwizardelev.exe\" OR process_name=\"\ - bytecodegenerator.exe\" OR process_name=\"camerasettingsuihost.exe\" OR process_name=\"\ - castsrv.exe\" OR process_name=\"certenrollctrl.exe\" OR process_name=\"checknetisolation.exe\"\ - \ OR process_name=\"clipup.exe\" OR process_name=\"cloudexperiencehostbroker.exe\"\ - \ OR process_name=\"cloudnotifications.exe\" OR process_name=\"cloudstoragewizard.exe\"\ - \ OR process_name=\"compmgmtlauncher.exe\" OR process_name=\"compattelrunner.exe\"\ - \ OR process_name=\"computerdefaults.exe\" OR process_name=\"credentialuibroker.exe\"\ - \ OR process_name=\"dfdwiz.exe\" OR process_name=\"dwwin.exe\" OR process_name=\"\ - dataexchangehost.exe\" OR process_name=\"defrag.exe\" OR process_name=\"devicedisplayobjectprovider.exe\"\ - \ OR process_name=\"deviceeject.exe\" OR process_name=\"deviceenroller.exe\" OR\ - \ process_name=\"devicepairingwizard.exe\" OR process_name=\"deviceproperties.exe\"\ - \ OR process_name=\"disksnapshot.exe\" OR process_name=\"dism.exe\" OR process_name=\"\ - displayswitch.exe\" OR process_name=\"dmnotificationbroker.exe\" OR process_name=\"\ - dmomacpmo.exe\" OR process_name=\"dpiscaling.exe\" OR process_name=\"dsmusertask.exe\"\ - \ OR process_name=\"dxpserver.exe\" OR process_name=\"edpcleanup.exe\" OR process_name=\"\ - eosnotify.exe\" OR process_name=\"eap3host.exe\" OR process_name=\"easpoliciesbrokerhost.exe\"\ - \ OR process_name=\"easeofaccessdialog.exe\" OR process_name=\"ehstorauthn.exe\"\ - \ OR process_name=\"fxscover.exe\" OR process_name=\"fxssvc.exe\" OR process_name=\"\ - fxsunatd.exe\" OR process_name=\"filehistory.exe\" OR process_name=\"fondue.exe\"\ - \ OR process_name=\"gamepanel.exe\" OR process_name=\"genvalobj.exe\" OR process_name=\"\ - gettingstarted.exe\" OR process_name=\"hostname.exe\" OR process_name=\"icsentitlementhost.exe\"\ - \ OR process_name=\"infdefaultinstall.exe\" OR process_name=\"installagent.exe\"\ - \ OR process_name=\"languagecomponentsinstallercomhandler.exe\" OR process_name=\"\ - launchtm.exe\" OR process_name=\"launchwinapp.exe\" OR process_name=\"legacynetuxhost.exe\"\ - \ OR process_name=\"licensemanagershellext.exe\" OR process_name=\"licensingui.exe\"\ - \ OR process_name=\"locationnotificationwindows.exe\" OR process_name=\"locationnotifications.exe\"\ - \ OR process_name=\"locator.exe\" OR process_name=\"lockapphost.exe\" OR process_name=\"\ - lockscreencontentserver.exe\" OR process_name=\"logonui.exe\" OR process_name=\"\ - lsaiso.exe\" OR process_name=\"mdeserver.exe\" OR process_name=\"mdmagent.exe\"\ - \ OR process_name=\"mdmappinstaller.exe\" OR process_name=\"mrinfo.exe\" OR process_name=\"\ - mrt.exe\" OR process_name=\"mschedexe.exe\" OR process_name=\"magnify.exe\" OR process_name=\"\ - mbaeparsertask.exe\" OR process_name=\"mdres.exe\" OR process_name=\"mdsched.exe\"\ - \ OR process_name=\"migautoplay.exe\" OR process_name=\"mpsigstub.exe\" OR process_name=\"\ - msspellcheckinghost.exe\" OR process_name=\"muiunattend.exe\" OR process_name=\"\ - multidigimon.exe\" OR process_name=\"musnotification.exe\" OR process_name=\"musnotificationux.exe\"\ - \ OR process_name=\"napstat.exe\" OR process_name=\"netstat.exe\" OR process_name=\"\ - narrator.exe\" OR process_name=\"netcfgnotifyobjecthost.exe\" OR process_name=\"\ - netevtfwdr.exe\" OR process_name=\"netproj.exe\" OR process_name=\"netplwiz.exe\"\ - \ OR process_name=\"networkuxbroker.exe\";\n$cond_2 = \n| from $ssa_input \n| where\ - \ process_name=\"openwith.exe\" OR process_name=\"optionalfeatures.exe\" OR process_name=\"\ - pathping.exe\" OR process_name=\"ping.exe\" OR process_name=\"passwordonwakesettingflyout.exe\"\ - \ OR process_name=\"pickerhost.exe\" OR process_name=\"pkgmgr.exe\" OR process_name=\"\ - pnpunattend.exe\" OR process_name=\"pnputil.exe\" OR process_name=\"presentationhost.exe\"\ - \ OR process_name=\"presentationsettings.exe\" OR process_name=\"printbrmui.exe\"\ - \ OR process_name=\"printdialoghost.exe\" OR process_name=\"printdialoghost3d.exe\"\ - \ OR process_name=\"printisolationhost.exe\" OR process_name=\"proximityuxhost.exe\"\ - \ OR process_name=\"rdspnf.exe\" OR process_name=\"rmactivate.exe\" OR process_name=\"\ - rmactivate_isv.exe\" OR process_name=\"rmactivate_ssp.exe\" OR process_name=\"rmactivate_ssp_isv.exe\"\ - \ OR process_name=\"route.exe\" OR process_name=\"rdpsa.exe\" OR process_name=\"\ - rdpsaproxy.exe\" OR process_name=\"rdpsauachelper.exe\" OR process_name=\"reagentc.exe\"\ - \ OR process_name=\"recoverydrive.exe\" OR process_name=\"register-cimprovider.exe\"\ - \ OR process_name=\"registeriepkeys.exe\" OR process_name=\"relpost.exe\" OR process_name=\"\ - remoteposworker.exe\" OR process_name=\"rmclient.exe\" OR process_name=\"robocopy.exe\"\ - \ OR process_name=\"rpcping.exe\" OR process_name=\"runlegacycplelevated.exe\" OR\ - \ process_name=\"runtimebroker.exe\" OR process_name=\"sihclient.exe\" OR process_name=\"\ - searchfilterhost.exe\" OR process_name=\"searchindexer.exe\" OR process_name=\"\ - searchprotocolhost.exe\" OR process_name=\"secedit.exe\" OR process_name=\"sensordataservice.exe\"\ - \ OR process_name=\"setieinstalleddate.exe\" OR process_name=\"settingsynchost.exe\"\ - \ OR process_name=\"slidetoshutdown.exe\" OR process_name=\"smartscreensettings.exe\"\ - \ OR process_name=\"sndvol.exe\" OR process_name=\"snippingtool.exe\" OR process_name=\"\ - soundrecorder.exe\" OR process_name=\"spaceagent.exe\" OR process_name=\"sppextcomobj.exe\"\ - \ OR process_name=\"srtasks.exe\" OR process_name=\"stikynot.exe\" OR process_name=\"\ - synchost.exe\" OR process_name=\"sysreseterr.exe\" OR process_name=\"systempropertiesadvanced.exe\"\ - \ OR process_name=\"systempropertiescomputername.exe\" OR process_name=\"systempropertiesdataexecutionprevention.exe\"\ - \ OR process_name=\"systempropertieshardware.exe\" OR process_name=\"systempropertiesperformance.exe\"\ - \ OR process_name=\"systempropertiesprotection.exe\" OR process_name=\"systempropertiesremote.exe\"\ - \ OR process_name=\"systemsettingsadminflows.exe\" OR process_name=\"systemsettingsbroker.exe\"\ - \ OR process_name=\"systemsettingsremovedevice.exe\" OR process_name=\"tcpsvcs.exe\"\ - \ OR process_name=\"tracert.exe\" OR process_name=\"tstheme.exe\" OR process_name=\"\ - tswbprxy.exe\" OR process_name=\"tapiunattend.exe\" OR process_name=\"taskmgr.exe\"\ - \ OR process_name=\"thumbnailextractionhost.exe\" OR process_name=\"tokenbrokercookies.exe\"\ - \ OR process_name=\"tpminit.exe\" OR process_name=\"tswpfwrp.exe\" OR process_name=\"\ - ui0detect.exe\" OR process_name=\"upgraderesultsui.exe\" OR process_name=\"useraccountbroker.exe\"\ - \ OR process_name=\"useraccountcontrolsettings.exe\" OR process_name=\"usoclient.exe\"\ - \ OR process_name=\"utilman.exe\" OR process_name=\"vssvc.exe\" OR process_name=\"\ - vaultcmd.exe\" OR process_name=\"vaultsysui.exe\" OR process_name=\"wfs.exe\" OR\ - \ process_name=\"wmpdmc.exe\" OR process_name=\"wpdshextautoplay.exe\" OR process_name=\"\ - wscollect.exe\" OR process_name=\"wsmanhttpconfig.exe\" OR process_name=\"wsreset.exe\"\ - \ OR process_name=\"wudfhost.exe\" OR process_name=\"wwahost.exe\" OR process_name=\"\ - wallpaperhost.exe\" OR process_name=\"webcache.exe\" OR process_name=\"werfault.exe\"\ - \ OR process_name=\"werfaultsecure.exe\" OR process_name=\"winsat.exe\" OR process_name=\"\ - windows.media.backgroundplayback.exe\" OR process_name=\"windowsactiondialog.exe\"\ - \ OR process_name=\"windowsanytimeupgrade.exe\" OR process_name=\"windowsanytimeupgraderesults.exe\"\ - ;\n$cond_3 = \n| from $ssa_input \n| where process_name=\"windowsanytimeupgradeui.exe\"\ - \ OR process_name=\"windowsupdateelevatedinstaller.exe\" OR process_name=\"workfolders.exe\"\ - \ OR process_name=\"wpcmon.exe\" OR process_name=\"acu.exe\" OR process_name=\"\ - aitagent.exe\" OR process_name=\"aitstatic.exe\" OR process_name=\"alg.exe\" OR\ - \ process_name=\"appidcertstorecheck.exe\" OR process_name=\"appidpolicyconverter.exe\"\ - \ OR process_name=\"at.exe\" OR process_name=\"attrib.exe\" OR process_name=\"audiodg.exe\"\ - \ OR process_name=\"auditpol.exe\" OR process_name=\"autochk.exe\" OR process_name=\"\ - autoconv.exe\" OR process_name=\"autofmt.exe\" OR process_name=\"baaupdate.exe\"\ - \ OR process_name=\"backgroundtaskhost.exe\" OR process_name=\"bcastdvr.exe\" OR\ - \ process_name=\"bcdboot.exe\" OR process_name=\"bcdedit.exe\" OR process_name=\"\ - bdechangepin.exe\" OR process_name=\"bdeunlock.exe\" OR process_name=\"bitsadmin.exe\"\ - \ OR process_name=\"bootcfg.exe\" OR process_name=\"bootim.exe\" OR process_name=\"\ - bootsect.exe\" OR process_name=\"bridgeunattend.exe\" OR process_name=\"browser_broker.exe\"\ - \ OR process_name=\"bthudtask.exe\" OR process_name=\"cacls.exe\" OR process_name=\"\ - calc.exe\" OR process_name=\"cdpreference.exe\" OR process_name=\"certreq.exe\"\ - \ OR process_name=\"certutil.exe\" OR process_name=\"change.exe\" OR process_name=\"\ - changepk.exe\" OR process_name=\"charmap.exe\" OR process_name=\"chglogon.exe\"\ - \ OR process_name=\"chgport.exe\" OR process_name=\"chgusr.exe\" OR process_name=\"\ - chkdsk.exe\" OR process_name=\"chkntfs.exe\" OR process_name=\"choice.exe\" OR process_name=\"\ - cipher.exe\" OR process_name=\"cleanmgr.exe\" OR process_name=\"cliconfg.exe\" OR\ - \ process_name=\"clip.exe\" OR process_name=\"cmd.exe\" OR process_name=\"cmdkey.exe\"\ - \ OR process_name=\"cmdl32.exe\" OR process_name=\"cmmon32.exe\" OR process_name=\"\ - cmstp.exe\" OR process_name=\"cofire.exe\" OR process_name=\"colorcpl.exe\" OR process_name=\"\ - comp.exe\" OR process_name=\"compact.exe\" OR process_name=\"conhost.exe\" OR process_name=\"\ - consent.exe\" OR process_name=\"control.exe\" OR process_name=\"convert.exe\" OR\ - \ process_name=\"credwiz.exe\" OR process_name=\"cscript.exe\" OR process_name=\"\ - csrss.exe\" OR process_name=\"ctfmon.exe\" OR process_name=\"cttune.exe\" OR process_name=\"\ - cttunesvr.exe\" OR process_name=\"dashost.exe\" OR process_name=\"dccw.exe\" OR\ - \ process_name=\"dcomcnfg.exe\" OR process_name=\"ddodiag.exe\" OR process_name=\"\ - dfrgui.exe\" OR process_name=\"dialer.exe\" OR process_name=\"diantz.exe\" OR process_name=\"\ - dinotify.exe\" OR process_name=\"diskpart.exe\" OR process_name=\"diskperf.exe\"\ - \ OR process_name=\"diskraid.exe\" OR process_name=\"dispdiag.exe\" OR process_name=\"\ - djoin.exe\" OR process_name=\"dllhost.exe\" OR process_name=\"dllhst3g.exe\" OR\ - \ process_name=\"dmcertinst.exe\" OR process_name=\"dmcfghost.exe\" OR process_name=\"\ - dmclient.exe\" OR process_name=\"dnscacheugc.exe\" OR process_name=\"doskey.exe\"\ - \ OR process_name=\"dpapimig.exe\" OR process_name=\"dpnsvr.exe\" OR process_name=\"\ - driverquery.exe\" OR process_name=\"drvcfg.exe\" OR process_name=\"drvinst.exe\"\ - \ OR process_name=\"dsregcmd.exe\" OR process_name=\"dstokenclean.exe\" OR process_name=\"\ - dvdplay.exe\" OR process_name=\"dvdupgrd.exe\" OR process_name=\"dwm.exe\" OR process_name=\"\ - dxdiag.exe\" OR process_name=\"easinvoker.exe\" OR process_name=\"efsui.exe\";\n\ - $cond_4 = \n| from $ssa_input \n| where process_name=\"embeddedapplauncher.exe\"\ - \ OR process_name=\"esentutl.exe\" OR process_name=\"eudcedit.exe\" OR process_name=\"\ - eventcreate.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"expand.exe\"\ - \ OR process_name=\"extrac32.exe\" OR process_name=\"fc.exe\" OR process_name=\"\ - fhmanagew.exe\" OR process_name=\"find.exe\" OR process_name=\"findstr.exe\" OR\ - \ process_name=\"finger.exe\" OR process_name=\"fixmapi.exe\" OR process_name=\"\ - fltmc.exe\" OR process_name=\"fodhelper.exe\" OR process_name=\"fontdrvhost.exe\"\ - \ OR process_name=\"fontview.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"\ - fsavailux.exe\" OR process_name=\"fsquirt.exe\" OR process_name=\"fsutil.exe\" OR\ - \ process_name=\"ftp.exe\" OR process_name=\"fvenotify.exe\" OR process_name=\"\ - fveprompt.exe\" OR process_name=\"getmac.exe\" OR process_name=\"gpresult.exe\"\ - \ OR process_name=\"gpscript.exe\" OR process_name=\"gpupdate.exe\" OR process_name=\"\ - grpconv.exe\" OR process_name=\"hdwwiz.exe\" OR process_name=\"help.exe\" OR process_name=\"\ - hwrcomp.exe\" OR process_name=\"hwrreg.exe\" OR process_name=\"icacls.exe\" OR process_name=\"\ - icardagt.exe\" OR process_name=\"icsunattend.exe\" OR process_name=\"ie4uinit.exe\"\ - \ OR process_name=\"ieunatt.exe\" OR process_name=\"ieetwcollector.exe\" OR process_name=\"\ - iexpress.exe\" OR process_name=\"immersivetpmvscmgrsvr.exe\" OR process_name=\"\ - ipconfig.exe\" OR process_name=\"irftp.exe\" OR process_name=\"iscsicli.exe\" OR\ - \ process_name=\"iscsicpl.exe\" OR process_name=\"isoburn.exe\" OR process_name=\"\ - klist.exe\" OR process_name=\"ksetup.exe\" OR process_name=\"ktmutil.exe\" OR process_name=\"\ - label.exe\" OR process_name=\"licensingdiag.exe\" OR process_name=\"lodctr.exe\"\ - \ OR process_name=\"logagent.exe\" OR process_name=\"logman.exe\" OR process_name=\"\ - logoff.exe\" OR process_name=\"lpkinstall.exe\" OR process_name=\"lpksetup.exe\"\ - \ OR process_name=\"lpremove.exe\" OR process_name=\"lsass.exe\" OR process_name=\"\ - lsm.exe\" OR process_name=\"makecab.exe\" OR process_name=\"manage-bde.exe\" OR\ - \ process_name=\"mblctr.exe\" OR process_name=\"mcbuilder.exe\" OR process_name=\"\ - mctadmin.exe\" OR process_name=\"mfpmp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"\ - mobsync.exe\" OR process_name=\"mountvol.exe\" OR process_name=\"mpnotify.exe\"\ - \ OR process_name=\"msconfig.exe\" OR process_name=\"msdt.exe\" OR process_name=\"\ - msdtc.exe\" OR process_name=\"msfeedssync.exe\" OR process_name=\"msg.exe\" OR process_name=\"\ - mshta.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"msinfo32.exe\" OR\ - \ process_name=\"mspaint.exe\" OR process_name=\"msra.exe\" OR process_name=\"mstsc.exe\"\ - \ OR process_name=\"mtstocom.exe\" OR process_name=\"nbtstat.exe\" OR process_name=\"\ - ndadmin.exe\" OR process_name=\"net.exe\" OR process_name=\"net1.exe\" OR process_name=\"\ - netbtugc.exe\" OR process_name=\"netcfg.exe\" OR process_name=\"netiougc.exe\" OR\ - \ process_name=\"netsh.exe\" OR process_name=\"newdev.exe\" OR process_name=\"nltest.exe\"\ - \ OR process_name=\"notepad.exe\" OR process_name=\"nslookup.exe\" OR process_name=\"\ - ntoskrnl.exe\" OR process_name=\"ntprint.exe\" OR process_name=\"ocsetup.exe\" OR\ - \ process_name=\"odbcad32.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"\ - omadmclient.exe\" OR process_name=\"omadmprc.exe\";\n$cond_5 = \n| from $ssa_input\ - \ \n| where process_name=\"openfiles.exe\" OR process_name=\"osk.exe\" OR process_name=\"\ - p2phost.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"pcaui.exe\" OR process_name=\"\ - pcawrk.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"perfmon.exe\" OR process_name=\"\ - phoneactivate.exe\" OR process_name=\"plasrv.exe\" OR process_name=\"poqexec.exe\"\ - \ OR process_name=\"powercfg.exe\" OR process_name=\"prevhost.exe\" OR process_name=\"\ - print.exe\" OR process_name=\"printfilterpipelinesvc.exe\" OR process_name=\"printui.exe\"\ - \ OR process_name=\"proquota.exe\" OR process_name=\"provtool.exe\" OR process_name=\"\ - psr.exe\" OR process_name=\"pwlauncher.exe\" OR process_name=\"qappsrv.exe\" OR\ - \ process_name=\"qprocess.exe\" OR process_name=\"query.exe\" OR process_name=\"\ - quser.exe\" OR process_name=\"qwinsta.exe\" OR process_name=\"rasautou.exe\" OR\ - \ process_name=\"rasdial.exe\" OR process_name=\"raserver.exe\" OR process_name=\"\ - rasphone.exe\" OR process_name=\"rdpclip.exe\" OR process_name=\"rdpinput.exe\"\ - \ OR process_name=\"rdrleakdiag.exe\" OR process_name=\"recdisc.exe\" OR process_name=\"\ - recover.exe\" OR process_name=\"reg.exe\" OR process_name=\"regedt32.exe\" OR process_name=\"\ - regini.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"rekeywiz.exe\" OR\ - \ process_name=\"relog.exe\" OR process_name=\"repair-bde.exe\" OR process_name=\"\ - replace.exe\" OR process_name=\"reset.exe\" OR process_name=\"resmon.exe\" OR process_name=\"\ - rmttpmvscmgrsvr.exe\" OR process_name=\"rrinstaller.exe\" OR process_name=\"rstrui.exe\"\ - \ OR process_name=\"runas.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"\ - runonce.exe\" OR process_name=\"rwinsta.exe\" OR process_name=\"sbunattend.exe\"\ - \ OR process_name=\"sc.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"\ - sdbinst.exe\" OR process_name=\"sdchange.exe\" OR process_name=\"sdclt.exe\" OR\ - \ process_name=\"sdiagnhost.exe\" OR process_name=\"secinit.exe\" OR process_name=\"\ - services.exe\" OR process_name=\"sessionmsg.exe\" OR process_name=\"sethc.exe\"\ - \ OR process_name=\"setspn.exe\" OR process_name=\"setupcl.exe\" OR process_name=\"\ - setupugc.exe\" OR process_name=\"setx.exe\" OR process_name=\"sfc.exe\" OR process_name=\"\ - shadow.exe\" OR process_name=\"shrpubw.exe\" OR process_name=\"shutdown.exe\" OR\ - \ process_name=\"sigverif.exe\" OR process_name=\"sihost.exe\" OR process_name=\"\ - slui.exe\" OR process_name=\"smss.exe\" OR process_name=\"snmptrap.exe\" OR process_name=\"\ - sort.exe\" OR process_name=\"spinstall.exe\" OR process_name=\"spoolsv.exe\" OR\ - \ process_name=\"sppsvc.exe\" OR process_name=\"spreview.exe\" OR process_name=\"\ - srdelayed.exe\" OR process_name=\"subst.exe\" OR process_name=\"svchost.exe\" OR\ - \ process_name=\"sxstrace.exe\" OR process_name=\"syskey.exe\" OR process_name=\"\ - systeminfo.exe\" OR process_name=\"systemreset.exe\" OR process_name=\"systray.exe\"\ - \ OR process_name=\"tabcal.exe\" OR process_name=\"takeown.exe\" OR process_name=\"\ - taskeng.exe\" OR process_name=\"taskhost.exe\" OR process_name=\"taskhostw.exe\"\ - \ OR process_name=\"taskkill.exe\" OR process_name=\"tasklist.exe\" OR process_name=\"\ - taskmgr.exe\" OR process_name=\"tcmsetup.exe\" OR process_name=\"timeout.exe\" OR\ - \ process_name=\"tpmvscmgr.exe\" OR process_name=\"tpmvscmgrsvr.exe\";\n$cond_6\ - \ = \n| from $ssa_input \n| where process_name=\"tracerpt.exe\" OR process_name=\"\ - tscon.exe\" OR process_name=\"tsdiscon.exe\" OR process_name=\"tskill.exe\" OR process_name=\"\ - typeperf.exe\" OR process_name=\"tzsync.exe\" OR process_name=\"tzutil.exe\" OR\ - \ process_name=\"ucsvc.exe\" OR process_name=\"unlodctr.exe\" OR process_name=\"\ - unregmp2.exe\" OR process_name=\"upnpcont.exe\" OR process_name=\"userinit.exe\"\ - \ OR process_name=\"vds.exe\" OR process_name=\"vdsldr.exe\" OR process_name=\"\ - verclsid.exe\" OR process_name=\"verifier.exe\" OR process_name=\"verifiergui.exe\"\ - \ OR process_name=\"vmicsvc.exe\" OR process_name=\"vssadmin.exe\" OR process_name=\"\ - w32tm.exe\" OR process_name=\"waitfor.exe\" OR process_name=\"wbadmin.exe\" OR process_name=\"\ - wbengine.exe\" OR process_name=\"wecutil.exe\" OR process_name=\"wermgr.exe\" OR\ - \ process_name=\"wevtutil.exe\" OR process_name=\"wextract.exe\" OR process_name=\"\ - where.exe\" OR process_name=\"whoami.exe\" OR process_name=\"wiaacmgr.exe\" OR process_name=\"\ - wiawow64.exe\" OR process_name=\"wifitask.exe\" OR process_name=\"wimserv.exe\"\ - \ OR process_name=\"wininit.exe\" OR process_name=\"winload.exe\" OR process_name=\"\ - winlogon.exe\" OR process_name=\"winresume.exe\" OR process_name=\"winrs.exe\" OR\ - \ process_name=\"winrshost.exe\" OR process_name=\"winver.exe\" OR process_name=\"\ - wisptis.exe\" OR process_name=\"wkspbroker.exe\" OR process_name=\"wksprt.exe\"\ - \ OR process_name=\"wlanext.exe\" OR process_name=\"wlrmdr.exe\" OR process_name=\"\ - wowreg32.exe\" OR process_name=\"wpnpinst.exe\" OR process_name=\"wpr.exe\" OR process_name=\"\ - write.exe\" OR process_name=\"wscript.exe\" OR process_name=\"wsmprovhost.exe\"\ - \ OR process_name=\"wsqmcons.exe\" OR process_name=\"wuapihost.exe\" OR process_name=\"\ - wuapp.exe\" OR process_name=\"wuauclt.exe\" OR process_name=\"wusa.exe\" OR process_name=\"\ - xcopy.exe\" OR process_name=\"xpsrchvw.exe\" OR process_name=\"xwizard.exe\";\n\n\ - | from $cond_1 \n| union $cond_2 \n| union $cond_3 \n| union $cond_4 \n| union $cond_5\ - \ \n| union $cond_6 \n| where match_regex(process_path, /(?i)\\\\windows\\\\system32/)=false\ - \ AND match_regex(process_path, /(?i)\\\\windows\\\\syswow64/)=false \n| eval start_time=timestamp,\ - \ end_time=timestamp, entities=mvappend(device, user), body=create_map([\"event_id\"\ - , event_id, \"process_path\", process_path, \"process_name\", process_name]) \n\ - | into write_ssa_detected_events();" +search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); + + $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" + OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" + OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" + OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" + OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" + OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" + OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" + OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" + OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" + OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR + process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR + process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" + OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR + process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" + OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" + OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR + process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" + OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" + OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" + OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" + OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" + OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" + OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" + OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" + OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" + OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR + process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" + OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" + OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" + OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" + OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" + OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" + OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" + OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" + OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" + OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" + OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; + + $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" + OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" + OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" + OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" + OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" + OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR + process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" + OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR + process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" + OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" + OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" + OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" + OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" + OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" + OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR + process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" + OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" + OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" + OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" + OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" + OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" + OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" + OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" + OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" + OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" + OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" + OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" + OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" + OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" + OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR + process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR + process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" + OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" + OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" + OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" + OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" + OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" + OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" + OR process_name="windowsanytimeupgraderesults.exe"; + + $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR + process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" + OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" + OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" + OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" + OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" + OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" + OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" + OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" + OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" + OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" + OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" + OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" + OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" + OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" + OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" + OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" + OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" + OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" + OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" + OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" + OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" + OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" + OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" + OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" + OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" + OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" + OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" + OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" + OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" + OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" + OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" + OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" + OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" + OR process_name="easinvoker.exe" OR process_name="efsui.exe"; + + $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" + OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" + OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" + OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" + OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" + OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" + OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" + OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" + OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" + OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" + OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" + OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" + OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" + OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" + OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" + OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" + OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" + OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" + OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" + OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" + OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" + OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" + OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" + OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" + OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" + OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" + OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" + OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" + OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" + OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" + OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" + OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" + OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" + OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; + + $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" + OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" + OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" + OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" + OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" + OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" + OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" + OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" + OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" + OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" + OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" + OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" + OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" + OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" + OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" + OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" + OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" + OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" + OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" + OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" + OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" + OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" + OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" + OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" + OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" + OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" + OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" + OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" + OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" + OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" + OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" + OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" + OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" + OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; + + $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" + OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" + OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" + OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" + OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" + OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" + OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" + OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" + OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" + OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" + OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" + OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" + OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" + OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" + OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" + OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" + OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" + OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" + OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" + OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; + + | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | + union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", + event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Windows Defense Evasion Tactics diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/unusually_long_command_line.yml index a91f69f5ed..c5b719e75c 100644 --- a/dist/ssa/detections/unusually_long_command_line.yml +++ b/dist/ssa/detections/unusually_long_command_line.yml @@ -20,47 +20,20 @@ product: references: [] risk_message: A process $process_name$ with a long commandline $cmd_line$ executed in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Unusual Processes - cis20: - - CIS 8 - confidence: 40 - context: - - source:endpoint - - stage: Defense Evasion - impact: 30 - kill_chain_phases: - - Actions on Objectives - nist: - - PR.PT - - DE.CM - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: " \n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)) \n| eval cmd_line=ucast(map_get(input_event, \"\ - process\"), \"string\", null), dest_user_id=ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), dest_device_id=ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line!=null and dest_user_id!=null \n| eval cmd_line_norm=replace(cast(cmd_line,\ - \ \"string\"), /\\s(--?\\w+)\n|(\\/\\w+)/, \" ARG\"), cmd_line_norm=replace(cmd_line_norm,\ - \ /\\w:\\\\[^\\s]+/, \"PATH\"), cmd_line_norm=replace(cmd_line_norm, /\\d+/, \"\ - N\"), input=parse_double(len(coalesce(cmd_line_norm, \"\"))) \n| select timestamp,\ - \ process_name, dest_device_id, dest_user_id, cmd_line, input \n| adaptive_threshold\ - \ algorithm=\"quantile\" entity=\"process_name\" window=60480000 \n| where label\ - \ AND quantile>0.99 \n| first_time_event input_columns=[\"dest_device_id\", \"cmd_line\"\ - ] \n| where first_time_dest_device_id_cmd_line \n| eval start_time = timestamp,\ - \ end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map([\"\ - event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\", process_name]) \n\ - | into write_ssa_detected_events();" +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval + cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, + /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, + ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, + input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 + | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", + "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", + event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' tags: analytic_story: - Unusual Processes diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml index 04b8afba0e..32b1e15fbb 100644 --- a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml @@ -20,51 +20,20 @@ references: - https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Windows Log Manipulation - - Ransomware - - Clop Ransomware - cis20: - - CIS 8 - - CIS 13 - confidence: 90 - context: - - source:endpoint - - stage: Defense Evasion - impact: 70 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1070 - - T1070.001 - nist: - - PR.DS - - PR.IP - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% cl %\") AND (match_regex(cmd_line,\ - \ /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,\ - \ /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,\ - \ /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name=\"\ - wevtutil.exe\" \n| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ - \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ - ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ - \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ - \ \"process_path\", process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, + /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, + /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, + /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' tags: analytic_story: - Windows Log Manipulation diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml index 6bc759ee40..9c20f4a7af 100644 --- a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml @@ -20,48 +20,17 @@ references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ -savedsearch_annotations: - analytic_story: - - Windows Log Manipulation - - Ransomware - cis20: - - CIS 8 - - CIS 13 - confidence: 90 - context: - - source:endpoint - - stage: Defense Evasion - impact: 70 - kill_chain_phases: - - Exploitation - mitre_attack: - - T1070 - - T1070.001 - nist: - - PR.DS - - PR.IP - observable: - - name: dest_device_id - role: - - Victim - type: Hostname - - name: dest_user_id - role: - - Victim - type: user -search: "\n| from read_ssa_enriched_events() \n| eval timestamp=parse_long(ucast(map_get(input_event,\ - \ \"_time\"), \"string\", null)), cmd_line=ucast(map_get(input_event, \"process\"\ - ), \"string\", null), process_name=ucast(map_get(input_event, \"process_name\"),\ - \ \"string\", null), process_path=ucast(map_get(input_event, \"process_path\"),\ - \ \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ - ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ - , null) \n| where cmd_line IS NOT NULL AND like(cmd_line, \"% sl %\") AND like(cmd_line,\ - \ \"%/e:false%\") AND process_name=\"wevtutil.exe\" \n| eval start_time=timestamp,\ - \ end_time=timestamp, entities=mvappend(ucast(map_get(input_event, \"dest_user_id\"\ - ), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"), \"string\"\ - , null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line, \"process_name\"\ - , process_name, \"parent_process_name\", parent_process_name, \"process_path\",\ - \ process_path]) \n| into write_ssa_detected_events();" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, + "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' tags: analytic_story: - Windows Log Manipulation From 3ecdae1e84bbc306e26aa3996fc87b1a813268d5 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 1 Nov 2021 17:43:37 -0700 Subject: [PATCH 6/7] minor --- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 0dad28f8eb..6fbcae0ce0 100644 --- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,7 +12,8 @@ product: - Splunk Behavioral Analytics references: - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml -risk_message: Malicious actor is dumping stored credentials from the registry sections +risk_m +essage: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, From 8d7ed3105bff7583010b42b9a3ce7acd600434e6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 1 Nov 2021 17:44:38 -0700 Subject: [PATCH 7/7] Update attempted_credential_dump_from_registry_via_reg_exe.yml --- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 6fbcae0ce0..0dad28f8eb 100644 --- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,8 +12,7 @@ product: - Splunk Behavioral Analytics references: - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml -risk_m -essage: Malicious actor is dumping stored credentials from the registry sections +risk_message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,